Return to Question

[Edit] I did complete an analysis and framework of concepts that were included into my thesis for extensions to existing frameworks. All of the information in this thread was useful. The direct link to an extracted and shortened version of document is below for the interested. I'm always open to critical review and impression, though this site may not be the place for continuous debate.

 

http://www.levii.com/images/documents/secure%20development%20environments.docx

I'm working on a whitepaper [full disclosure: this is for my Master's thesis] that discusses security within the realm of secure software development, and while secure software engineering best practices and standards are well published and documented. The shortfall seems to be that most of these exclusively deal in the domain of the software creation itself and either completely miss, or gloss over the environment in which it is created.

I'm aware of the DISA Enclave STIG, Appendix A and the concept of security zones that are separated for the purposes of software development, testing and production and have personal experiences creating such environments ... what seems to be missing though are audit frameworks (similar to ISO27001 or NIST800-53) and best practice guides that are published in the community.

There is this stackexchange question: Data loss protection in software artifacts and I've also run across a couple of SANS.org whitepapers that very briefly discus the subject. They do seem though to miss at the fundamental question I have regarding industry-wide best practices, frameworks or processes.

So the question(s) I have for the IT Security community here are:

1.) What references are you aware of that discuss these types of separation?
2.) Of course there are policies must be in place, technical solutions in the network architecture, etc., - what do you base these on (or do you do as I have done ... base it off of personal experience and anecdotal knowledge)?
3.) Of the "big 3" ISMS standards (ISO27000, NIST800, FIPS140), do you think that any one is specifically best extended into such an environment? If none, is there a differing set that I should look into?

Of course, I'm absolutely open to anything else the community may have to say on the subject. I've seen some commercial offerings ... they are, of course, reluctant to give out a whole lot of information on their tools, techniques and processes.

[Edit] I did complete an analysis and framework of concepts that were included into my thesis for extensions to existing frameworks. All of the information in this thread was useful. The direct link to an extracted and shortened version of document is below for the interested. I'm always open to critical review and impression, though this site may not be the place for continuous debate.

http://www.levii.com/images/documents/secure%20development%20environments.docx

I'm working on a whitepaper [full disclosure: this is for my Master's thesis] that discusses security within the realm of secure software development, and while secure software engineering best practices and standards are well published and documented. The shortfall seems to be that most of these exclusively deal in the domain of the software creation itself and either completely miss, or gloss over the environment in which it is created.

I'm aware of the DISA Enclave STIG, Appendix A and the concept of security zones that are separated for the purposes of software development, testing and production and have personal experiences creating such environments ... what seems to be missing though are audit frameworks (similar to ISO27001 or NIST800-53) and best practice guides that are published in the community.

There is this stackexchange question: Data loss protection in software artifacts and I've also run across a couple of SANS.org whitepapers that very briefly discus the subject. They do seem though to miss at the fundamental question I have regarding industry-wide best practices, frameworks or processes.

So the question(s) I have for the IT Security community here are:

1.) What references are you aware of that discuss these types of separation?
2.) Of course there are policies must be in place, technical solutions in the network architecture, etc., - what do you base these on (or do you do as I have done ... base it off of personal experience and anecdotal knowledge)?
3.) Of the "big 3" ISMS standards (ISO27000, NIST800, FIPS140), do you think that any one is specifically best extended into such an environment? If none, is there a differing set that I should look into?

Of course, I'm absolutely open to anything else the community may have to say on the subject. I've seen some commercial offerings ... they are, of course, reluctant to give out a whole lot of information on their tools, techniques and processes.

[Edit] I did complete an analysis and framework of concepts that were included into my thesis for extensions to existing frameworks. All of the information in this thread was useful. The direct link to an extracted and shortened version of document is below for the interested. I'm always open to critical review and impression, though this site may not be the place for continuous debate.

http://www.levii.com/images/documents/secure%20development%20environments.docx

I'm working on a whitepaper [full disclosure: this is for my Master's thesis] that discusses security within the realm of secure software development, and while secure software engineering best practices and standards are well published and documented. The shortfall seems to be that most of these exclusively deal in the domain of the software creation itself and either completely miss, or gloss over the environment in which it is created.

I'm aware of the DISA Enclave STIG, Appendix A and the concept of security zones that are separated for the purposes of software development, testing and production and have personal experiences creating such environments ... what seems to be missing though are audit frameworks (similar to ISO27001 or NIST800-53) and best practice guides that are published in the community.

There is this stackexchange question: Data loss protection in software artifacts and I've also run across a couple of SANS.org whitepapers that very briefly discus the subject. They do seem though to miss at the fundamental question I have regarding industry-wide best practices, frameworks or processes.

So the question(s) I have for the IT Security community here are:

1.) What references are you aware of that discuss these types of separation?
2.) Of course there are policies must be in place, technical solutions in the network architecture, etc., - what do you base these on (or do you do as I have done ... base it off of personal experience and anecdotal knowledge)?
3.) Of the "big 3" ISMS standards (ISO27000, NIST800, FIPS140), do you think that any one is specifically best extended into such an environment? If none, is there a differing set that I should look into?

Of course, I'm absolutely open to anything else the community may have to say on the subject. I've seen some commercial offerings ... they are, of course, reluctant to give out a whole lot of information on their tools, techniques and processes.

[Edit] I did complete an analysis and framework of concepts that were included into my thesis for extensions to existing frameworks. All of the information in this thread was useful. The direct link to an extracted and shortened version of document is below for the interested. I'm always open to critical review and impression, though this site may not be the place for continuous debate.

http://www.levii.com/images/documents/secure%20development%20environments.docx

I'm working on a whitepaper [full disclosure: this is for my Master's thesis] that discusses security within the realm of secure software development, and while secure software engineering best practices and standards are well published and documented. The shortfall seems to be that most of these exclusively deal in the domain of the software creation itself and either completely miss, or gloss over the environment in which it is created.

I'm aware of the DISA Enclave STIG, Appendix A and the concept of security zones that are separated for the purposes of software development, testing and production and have personal experiences creating such environments ... what seems to be missing though are audit frameworks (similar to ISO27001 or NIST800-53) and best practice guides that are published in the community.

There is this stackexchange question: Data loss protection in software artifacts and I've also run across a couple of SANS.org whitepapers that very briefly discus the subject. They do seem though to miss at the fundamental question I have regarding industry-wide best practices, frameworks or processes.

So the question(s) I have for the IT Security community here are:

1.) What references are you aware of that discuss these types of separation?
2.) Of course there are policies must be in place, technical solutions in the network architecture, etc., - what do you base these on (or do you do as I have done ... base it off of personal experience and anecdotal knowledge)?
3.) Of the "big 3" ISMS standards (ISO27000, NIST800, FIPS140), do you think that any one is specifically best extended into such an environment? If none, is there a differing set that I should look into?

Of course, I'm absolutely open to anything else the community may have to say on the subject. I've seen some commercial offerings ... they are, of course, reluctant to give out a whole lot of information on their tools, techniques and processes.

[Edit] I did complete an analysis and framework of concepts that were included into my thesis for extensions to existing frameworks. All of the information in this thread was useful. The direct link to an extracted and shortened version of document is below for the interested. I'm always open to critical review and impression, though this site may not be the place for continuous debate.

http://www.levii.com/images/documents/secure%20development%20environments.docx

I'm working on a whitepaper [full disclosure: this is for my Master's thesis] that discusses security within the realm of secure software development, and while secure software engineering best practices and standards are well published and documented. The shortfall seems to be that most of these exclusively deal in the domain of the software creation itself and either completely miss, or gloss over the environment in which it is created.

I'm aware of the DISA Enclave STIG, Appendix A and the concept of security zones that are separated for the purposes of software development, testing and production and have personal experiences creating such environments ... what seems to be missing though are audit frameworks (similar to ISO27001 or NIST800-53) and best practice guides that are published in the community.

There is this stackexchange question: Data loss protection in software artifacts and I've also run across a couple of SANS.org whitepapers that very briefly discus the subject. They do seem though to miss at the fundamental question I have regarding industry-wide best practices, frameworks or processes.

So the question(s) I have for the IT Security community here are:

1.) What references are you aware of that discuss these types of separation?
2.) Of course there are policies must be in place, technical solutions in the network architecture, etc., - what do you base these on (or do you do as I have done ... base it off of personal experience and andictotal knowledge)?
3.) Of the "big 3" ISMS standards (ISO27000, NIST800, FIPS140), do you think that any one is specifically best extended into such an environment? If none, is there a differing set that I should look into?

Of course, I'm absolutely open to anything else the community may have to say on the subject. I've seen some commercial offerings ... they are, of course, reluctant to give out a whole lot of informtion on their tools, techniques and processes.

[Edit] I did complete an analysis and framework of concepts that were included into my thesis for extensions to existing frameworks. All of the information in this thread was useful. The direct link to an extracted and shortened version of document is below for the interested. I'm always open to critical review and impression, though this site may not be the place for continuous debate.

http://www.levii.com/images/documents/secure%20development%20environments.docx

I'm working on a whitepaper [full disclosure: this is for my Master's thesis] that discusses security within the realm of secure software development, and while secure software engineering best practices and standards are well published and documented. The shortfall seems to be that most of these exclusively deal in the domain of the software creation itself and either completely miss, or gloss over the environment in which it is created.

I'm aware of the DISA Enclave STIG, Appendix A and the concept of security zones that are separated for the purposes of software development, testing and production and have personal experiences creating such environments ... what seems to be missing though are audit frameworks (similar to ISO27001 or NIST800-53) and best practice guides that are published in the community.

There is this stackexchange question: Data loss protection in software artifacts and I've also run across a couple of SANS.org whitepapers that very briefly discus the subject. They do seem though to miss at the fundamental question I have regarding industry-wide best practices, frameworks or processes.

So the question(s) I have for the IT Security community here are:

1.) What references are you aware of that discuss these types of separation?
2.) Of course there are policies must be in place, technical solutions in the network architecture, etc., - what do you base these on (or do you do as I have done ... base it off of personal experience and anecdotal knowledge)?
3.) Of the "big 3" ISMS standards (ISO27000, NIST800, FIPS140), do you think that any one is specifically best extended into such an environment? If none, is there a differing set that I should look into?

Of course, I'm absolutely open to anything else the community may have to say on the subject. I've seen some commercial offerings ... they are, of course, reluctant to give out a whole lot of information on their tools, techniques and processes.