2

What are the best practices for network security for an internal development environment. Besides adhering to updates, antivirus, and firewall.

For instance, is it recommended to use an IDS/IPS like Snort? Should you be whitelisting outgoing ports? Developers often needs access to a variety of resources, especially for testing purposes.

What kind of security controls are often overlooked in these type of environments?

I know this is a very broad question, so any and all answers are appreciated.

EDIT: The network is an internet connected LAN.

  • Is a stand-alone network? Or connected to the Internet somehow? – RoraΖ Feb 18 '15 at 18:07
  • It is connected to the internet. – Alex Urcioli Feb 18 '15 at 18:16
1

Yes, follow a iSMS such as ISO 27002, PCI DSS, Visible Ops Security, or similar.

Overlooked controls include 2FA authentication and TLS protection of developer repos (e.g., GitLab, Subversion, Atlassian, Perforce, et al) that conform to SSL Labs criteria, as well as other components of Application Lifecycle Management (ALM), such as tools for bugtracking, code documentation, code review, collaboration, et al. API keys are always at risk: developers accidentally leave these in their code, .git/.svn folders, etc. Be aware, have backups, and have a backup plan when all else fails.

... And remember, the best penetration testers in the world attack developers, not apps -- http://www.darkreading.com/attacks-breaches/tiger-team-member-attacks-developers-not-apps/d/d-id/1129737

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.