Secure Development Environment for University dealing with private data

Question

We are a development team within a state public university. Much of our development deals with working with private student and employee data. Some applications push data from internal databases out to cloud-based solutions via secure file transfer or web services. New rules are coming down from the state-wide University System which governs us requiring protection between systems that access the Internet and access internal private data. These rules do not define what type of separation is required. The problem is not separation between development, staging, and production (which we already have) but rather protecting development workstations that can access private data from Internet-based attacks.

Other than client-based anti-virus and anti-spam, and network-based firewalls and proxy servers, what are reasonable steps that can be taken to protect development stations, or production servers that need to talk to cloud-based applications, from being a conduit to private data?

Answer 1

Take a look at the PCI standard, it has a lot of guidelines on how to secure credit card data that can also be applied to any confidential data:

https://www.pcisecuritystandards.org/

Not everything will apply to your environment, but it's a good starting point. It covers things like encryption of the data, key management, keeping audit trails, anonymizing data for test/dev machines, securing workstations that have access to the data, etc.

Build and Maintain a Secure Network

1. Install and maintain a firewall configuration to protect cardholder data
2. Do not use vendor-supplied defaults for system passwords and other security parameters

Protect Cardholder Data

1. Protect stored cardholder data
2. Encrypt transmission of cardholder data across open, public networks

Maintain a Vulnerability Management Program

1. Use and regularly update anti-virus software on all systems commonly affected by malware
2. Develop and maintain secure systems and applications

Implement Strong Access Control Measures

1. Restrict access to cardholder data by business need-to-know
2. Assign a unique ID to each person with computer access
3. Restrict physical access to cardholder data

Regularly Monitor and Test Networks \

1. Track and monitor all access to network resources and cardholder data
2. Regularly test security systems and processes

Maintain an Information Security Policy

1. Maintain a policy that addresses information security

(those steps are supposed to be numbered sequentially to match the PCI DSS steps, but StackExchange is smarter than I am and ignored the numbers I typed and started at "1" for each heading)