E.3.2 Environmental separation
Control Details
Objective
Separate and protect each environment involved in software development (i.e., development, build, test, deployment, model training)
Definition
Using network segmentation and access control to separate and protect each environment (e.g., endpoints, development, build, test, deployment, model training) involved in software development to protect from internal and external threats. Remote access to the build environment should be rare, logged, and require multi-party approval. Log and monitor access, particularly privileged access. Configure the environment's hosting infrastructure following a zero-trust architecture.
Assessment Questions
- How are environments involved in software development (e.g., endpoints, development, build, test, model training, deployment) separated and protected from physical and remote access to the build environment?
- How is access logged?
- How are approvals arranged for access to the build environment?
- How are the build environment workstations held to a security standard, e.g. up-to-date patches, anti-virus definitions, etc?