PO.5.2 Secure and harden development endpoints (i.e., endpoints for software designers, developers, testers, builders, etc.) to perform development-related …

Statement

Secure and harden development endpoints (i.e., endpoints for software designers, developers, testers, builders, etc.) to perform development-related tasks using a risk-based approach.

Example 1:

Configure each development endpoint based on approved hardening guides, checklists, etc.; for example, enable FIPS-compliant encryption of all sensitive data at rest and in transit.

Example 2:

Configure each development endpoint and the development resources to provide the least functionality needed by users and services and to enforce the principle of least privilege.

Example 3:

Continuously monitor the security posture of all development endpoints, including monitoring and auditing all use of privileged access.

Example 4:

Configure security controls and other tools involved in securing and hardening development endpoints to generate artifacts for their activities.

Example 5:

Require multi-factor authentication for all access to development endpoints and development resources.

Example 6:

Provide dedicated development endpoints on non-production networks for performing all development-related tasks. Provide separate endpoints on production networks for all other tasks.

Example 7:

Configure each development endpoint following a zero trust architecture.

1. Přehled

1.1 Odkazy

1.2 Identifikované požadavky

1.3 Související regulace

2. Identifikované požadavky

3. Související regulace

Propojené úkoly

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final