The NCSC’s Technology Assurance activities provide a means to gain confidence in the cyber security of the services and technologies on which the UK relies.
Pages
Page 18 of 35
4. Secure your development environment
Protecting your development environment from cyber attack enables you to maintain the confidentiality and integrity of your product data.
Having a regularly tested disaster recovery plan will enable you to get things back to normal as quickly as possible, if something does go wrong.
Examples of Defensive Measures
An IT asset management system should be used to maintain an accurate inventory of all the hardware and software used within your development environment. Records should also be kept of where all sensitive data is being stored, to ensure it is adequately protected.
Systems storing sensitive data should be patched and updated to the latest version as soon as possible. This helps protect them against the latest known vulnerabilities.
An access control system should be in place to ensure that only authorised users can access sensitive data. A suitably robust logging and auditing regime should also be adhered to. This will help detect unauthorised or unusual accesses, or data transfers.
Core business services (such as email and document management) should be either logically or physically separate from development environments. You should determine the degree of separation on a case-by-case basis. This will help to ensure that a successful attack on one system does not necessarily lead to the compromise of another.
Sensitive data, credentials and secret keys used to access and trigger the build should be protected and handled securely. This ensures that only authorised users have access to the build pipeline.
The development team should be aware of the impact of their digital footprint and what to do if they suspect they have received a phishing email or text message. This helps to reduce the likelihood that product data can be compromised through a social engineering attack.
A disaster recovery plan should be in place and adhered to. This should include the requirement that critical data be regularly backed up to a separate location and the process of restoring from it be frequently tested to ensure it works.
