Would the configuration described below violate any Security Technical Implementation Guides (STIGs)?

WebAPI Consumer WebAPI Service
Production Environment (WebAPI Consumer Production Private Key) Production Environment (WebAPI Consumer Production Public Key)
Pre-Production Environment (WebAPI Consumer Production Private Key) Staging Environment (WebAPI Consumer Production Public Key)

The web API is located in an extranet with four web methods, two of which allow the consumer to modify data in our database. The server is a Windows server and the web server is IIS.

The concerns are that the Pre-Production Server has access to the Production Server, when it should only have access to the Staging Server.

Also, that the Production Server Private Key has been loaded onto a Pre-Production Server.

Shouldn't different keys be used in different environments?

Here are some STIGs that I found that "might" be applicable.

enter image description here

EDIT: Adding this overview diagram demonstrating the answer.

enter image description here

  • 1
    Welcome to the community. I'm afraid we need more info about what this is about to fully answer the question... Dec 3, 2022 at 14:55
  • @SirMuffington Our sys admin is telling me that they cannot load the PROD Public Key onto our STAGE server because it violates a STIG. The consumer is pushing back demanding we specify which STIG is violated. The sys admin says they are sure it violates some STIG, but they do not know which one.
    – ADH
    Dec 3, 2022 at 15:04
  • 1
    And your product is what exactly? Software, a public facing web API or something else?.. Dec 3, 2022 at 17:59
  • 1
    I'm trying to form an answer, but I still have not enough information apparently. What STIG exactly is he referring to? Why do you have to have the staging environment in extranet/public?.. Dec 3, 2022 at 21:56
  • 2
    @ADH there is not enough information in the original post or the comments to provide a concrete answer. While it looks like something I would advise against (allowing test credentials to write to a prod database) I can't point to a STIG (or 800-53) control without specific details of how this works end to end and how the keys are being used.
    – kenlukas
    Dec 4, 2022 at 13:54

1 Answer 1


STIGs are product and version specific. As such, looking for a STIG in order to justify why your staging environment should not use the production key or access your production environment is probably not towards the right direction.

You can, however, refer to the NIST cybersecurity framework in order to justify why your test environments should not be able to access your production environment(s).

On the fact that the staging environment uses the production key, it's just a matter of what your security policy says; if it's not allowed, then the consumer has to comply.

Generally speaking, if the staging environment is as secure and restricted as the production environment, then using the same key does not pose any more risk. However, test environments are usually more relaxed security-wise than the production one, so common sense dictates that using production data (like the key) on these environments should be avoided.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .