Best practices to secure software developer workstations?
linux - Best security practices for software development and release? - Information Security Stack Exchange
Building security culture in dev teams - any recipes for success?
What do I need to know about security as a software developer?
Videos
The plan is to to give the software developer virtual Windows and Linux workstations hosted in cloud VDI that only have software development tools installed. No chat clients, email clients or even access to the general internet via CLI.
Network firewalls and web proxies would only allow access to preauthorized IP addresses and domains required to develop and test the software.
They would have to do any Googling, email and instant messaging access from their local workstation they use to remote into the developer workstation.
Any other suggestions?
Developers should never have direct access to the production environment. From an audit perspective this is a big no-no as this poses fraud risks. Also if one developer makes a mistake he can take down your critical systems which could have a high impact on your business.
The best practice is to have 4 separate environments, Development, Testing, Acceptance and Production. Developers can have access to testing and in some cases to acceptance, but NEVER to production. This is called the DTAP principle:
- The program or component is developed on a Development system. This development environment might have no testing capabilities.
Once the developer thinks it is ready, the product is copied to a Test environment, to verify it works as expected. This test environment is supposedly standardized and in close alignment with the target environment.
If the test is successful, the product is copied to an Acceptance test environment. During the Acceptance test, the customer will test the product in this environment to verify whether it meets their expectations.
If the customer accepts the product, it is deployed to a Production environment, making it available to all users of the system.
As said, if an auditor sees or even gets the slightest hint that a developer can get access to a production environment you will almost certainly get failed. If you want to perform audits, it's best done by an independent person/organisation. If you want to setup more processes and regulations have a look at the COBIT framework.
Make sure you define KPIs and SLAs to have a form of power to enforce your regulations.
so I'd agree with what @lucaskauffman and @terrychia have said so far but here are some more tips that might be useful to you in improving the control over your dev environment. Ultimately you should try and get to the kind of control level that lucas mentions but it might be a hard sell to jump straight to that so there's some intermediate steps you could take.
- Start by moving devs from read-write access to production to read-only. Introduce a change control process so that changes to production data are staged and applied in a controlled way, not by individual developers. If developers need to try things out then introduce a pre-prod environment and try things out there.
- Remove developer access to the server. Change management for all code changes, developers shouldn't have direct write access to the production server, one of the nice things about git is that it's easy to have a copy of the code so hopefully there shouldn't be any circumstances where direct code changes would be made to prod.
- Once you've got people working that way, ideally you wouldn't have people working on live data at all, they should work on anonymised sample data which reduces your risks of losing customer information. There are tools to anonymise data but even something as simple as a script which replaces names with Mr M Mouse and the like could help reduce the impact of someone taking a copy of the database away with them.
- if you can get as far as this point, then look at taking things further (e.g. COBIT/ITIL style models)
The huge point about all this is it will require good levels of buy-in from your management. all these steps cost money and will slow down the development/test process in the short term (in the long term they'll likely save the whole company though).
Getting that buy-in may be tricky if management don't see the problem. I'd suggest searching for horror stories of uncontrolled dev. environments, of even better if there have been problems in the one you're working in, use these as examples of things that could be avoided by adding a bit more process to things.