Hot answers tagged

19

I haven't personally had to make this decision, though I do work in an environment where such separation of duties is implemented. Are you the owner of this business or are you working for someone else? Reason I ask is because realistically this comes down to a business decision. (barring the obvious infosec perspective of - "SEPARATE ALL THE THINGS!") ...


16

Welcome to the world of enterprise IT security. As you've found out, it's easy for security departments to make recommendations waving vaguely at "best practice". It's much harder to implement this on the ground. But you can address this, and you will get some benefits. One-click deployments - new releases should be packaged so they can be installed easily. ...


6

I used to run a puppet installation, so I'll speak to what I did then. SSH Host Keys are ephemeral. So, when building a new system or rebuilding an existing one, we just let new keys be generated by SSHD when it first started. There were relatively few people SSHing into these machines, and when rebuilding the machines, we published the host key ...


4

This is a common problem and different dev teams solve this is a variety of ways. The best practice is to mitigate the risks appropriately. That sounds like a way of avoiding the question, but in cases like these, it's the only real way to approach the problem. What's "appropriate"? The threats are: Devs use their machines to create and release ...


3

DevOpsSec CI/CD pipelines generally refer to AWS environments with Auto Scaling and Lambda features, as well as provisioning through Terraform or CloudFormation. DevOps in 2017 should likely include agentless functionality, such as ServerSpec (and/or Test Kitchen). The DevOpsSec book from O'Reilly publishing does make mention to many of these paradigms. The ...


2

It's irrelevant. This is because the user is running with the permissions to access this folder, if the user gets compromised it doesn't matter in which folder the source code is stored. Make sure you use Bitlocker to encrypt the hard drives in case the endpoint gets stolen.


1

The request seems to match a butterfly vpn router (OpenWrt BTFLY-A 1.3.0 / LuCI 15.05 Branch), so someone probably used your IP for a vpn service in the past and there is an active endpoint querying it. https://forum.openwrt.org/t/how-to-flash-openwrt-on-a-butterfly-vpn-router/73652


1

You can use OpenSAMM or BSIMM frameworks to benchmark your development process in terms of security. After that you can calculate the risks for unimplemented/incomplete security practices to include in your main CSF-based risk assessment.


1

If the apps can be used to push app modifications to your production environment with regard to financial applications, they will be subject to SOX. Considering your Bitbucket, Jenkins and Nexus all are used for ensuring certain controls (e.g. controlled deployment to prevent pushing unauthorised code), they may be considered as part of the control ...


Only top voted, non community-wiki answers of a minimum length are eligible