PO.5.1 Separate and protect each environment involved in software development.

Statement

Separate and protect each environment involved in software development.

Example 1:

Use multi-factor, risk-based authentication and conditional access for each environment.

Example 10:

Configure and implement measures to secure the environments’ hosting infrastructures following a zero trust architecture.

Example 2:

Use network segmentation and access controls to separate the environments from each other and from production environments, and to separate components from each other within each non-production environment, in order to reduce attack surfaces and attackers’ lateral movement and privilege/access escalation.

Example 3:

Enforce authentication and tightly restrict connections entering and exiting each software development environment, including minimizing access to the internet to only what is necessary.

Example 4:

Minimize direct human access to toolchain systems, such as build services. Continuously monitor and audit all access attempts and all use of privileged access.

Example 5:

Minimize the use of production-environment software and services from non-production environments.

Example 6:

Regularly log, monitor, and audit trust relationships for authorization and access between the environments and between the components within each environment.

Example 7:

Continuously log and monitor operations and alerts across all components of the development environment to detect, respond, and recover from attempted and actual cyber incidents.

Example 8:

Configure security controls and other tools involved in separating and protecting the environments to generate artifacts for their activities.

Example 9:

Continuously monitor all software deployed in each environment for new vulnerabilities, and respond to vulnerabilities appropriately following a risk-based approach.

1. Přehled

1.1 Odkazy

1.2 Identifikované požadavky

1.3 Související regulace

2. Identifikované požadavky

3. Související regulace

Propojené úkoly

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final