Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

We are a development team within a state public university. Much of our development deals with working with private student and employee data. Some applications push data from internal databases out to cloud-based solutions via secure file transfer or web services. New rules are coming down from the state-wide University System which governs us requiring protection between systems that access the Internet and access internal private data. These rules do not define what type of separation is required. The problem is not separation between development, staging, and production (which we already have) but rather protecting development workstations that can access private data from Internet-based attacks.

Other than client-based anti-virus and anti-spam, and network-based firewalls and proxy servers, what are reasonable steps that can be taken to protect development stations, or production servers that need to talk to cloud-based applications, from being a conduit to private data?

share|improve this question
    
Cloud storage and security don't go together well... There's no guarantee somebody is not actively using this "secure conduit" as a side channel for leaking your private data to the 'Net. –  Deer Hunter Mar 27 '13 at 18:37
1  
Cloud storage needn't be a security risk - just encrypt your data before you write it to storage. Cloud servers and external services may be a risk, but that was a problem even before people started calling outside services "cloud services" –  Johnny Mar 27 '13 at 19:20
add comment

1 Answer

Take a look at the PCI standard, it has a lot of guidelines on how to secure credit card data that can also be applied to any confidential data:

https://www.pcisecuritystandards.org/

Not everything will apply to your environment, but it's a good starting point. It covers things like encryption of the data, key management, keeping audit trails, anonymizing data for test/dev machines, securing workstations that have access to the data, etc.

Build and Maintain a Secure Network

  1. Install and maintain a firewall configuration to protect cardholder data
  2. Do not use vendor-supplied defaults for system passwords and other security parameters

Protect Cardholder Data

  1. Protect stored cardholder data
  2. Encrypt transmission of cardholder data across open, public networks

Maintain a Vulnerability Management Program

  1. Use and regularly update anti-virus software on all systems commonly affected by malware
  2. Develop and maintain secure systems and applications

Implement Strong Access Control Measures

  1. Restrict access to cardholder data by business need-to-know
  2. Assign a unique ID to each person with computer access
  3. Restrict physical access to cardholder data

Regularly Monitor and Test Networks \

  1. Track and monitor all access to network resources and cardholder data
  2. Regularly test security systems and processes

Maintain an Information Security Policy

  1. Maintain a policy that addresses information security

(those steps are supposed to be numbered sequentially to match the PCI DSS steps, but StackExchange is smarter than I am and ignored the numbers I typed and started at "1" for each heading)

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.