Secure the engineering environment
The security of a workload relies on the security of the operational environments where it is developed. An attacker that compromises the development environment infrastructure can take over the workload and find vulnerabilities in it, add vulnerabilities to it, add backdoors to it, access the data in it, launch lateral attacks on other internal systems, and more. Effectively, development security depends on the overall security of the environment including the security of identities, networks, servers, containers, email, user endpoints, and other systems.
Attackers have now expanded their focus to include targeting user accounts, development environments and build processes, and so those systems must be defended in addition to ensuring that source code and configuration files do not contain security errors or have been tampered with. Access to source code and engineering systems should be managed, operated and secured through Zero Trust and least privilege access policies. Source code should be stored in a version controls systems such as a Git with access gated through conditional access policies and multifactor authentication. Engineering systems should be segmented, managed from privileged access workstations, by individuals (who’s privileged access is regularly reviewed) using separate authorized identities. All privileges access should be provided following Just-In-Time and Just-Enough-Access (JIT/JEA) principles and security logging should be enabled and provided to the security monitoring team.
6.1 Take a Zero Trust approach - At its core the Zero Trust model requires that each access request (user, service, or device) is verified as though it originated from an untrusted network, regardless of where the request originates or what resource it accesses. Base this always authenticate and authorize policy on all available data points, limit user access, especially privilede users, through Just-In-Time and Just-Enough-Access (JIT/JEA) policies and segment access to minimize the possible damage in the event of a breach.
Microsoft Learn: What is Zero Trust
6.2 Disallow direct commits to production branches - Configure your source control repositories to prevent developer accounts from making direct commits to production branches and to require code review and approval for all pull requests. This ensures that a single compromised/rogue developer account cannot make arbitrary changes to code for production systems.
6.3 Implement privileged access workstations - The use of hardened security workstations helps protect privileged users from internet attacks and threat vectors by providing a dedicated machine for sensitive tasks and separating these sensitive tasks and accounts from the daily use workstations.
- Microsoft Learn: Securing devices as part of the privileged access story
- Microsoft Learn: Deploying a privileged access solution
- See Practice 8.8 Implement operational terminals: Device security
6.4 Provide Secure virtual workstations - Microsoft Dev Box gives developers self-service access to ready-to-code cloud workstations called dev boxes. Dev boxes can be configured with tools, source code, and prebuilt binaries that are specific to a project, so developers can immediately start working - securely. Dev boxes are managed like all devices on the network and can be more easily kept up to date and secured through security settings, network configuration and organizational policies.
- Microsoft Learn: What is Microsoft Dev Box
6.5 Implement GitHub Codespaces - Created with security in mind, Codespaces provides a secure development environment through its built-in capabilities and native integration with the GitHub platform. Developers can quickly spin up a Codespace with only an IDE or browser and a GitHub account and work in a shared and secure development environment.
- GitHub: GitHub Codespaces
6.6 Secure deployment environments - Azure Deployment Environments empower development teams to quickly and easily spin up app infrastructure with project-based templates that establish consistency and best practices while maximizing security. This on-demand access to secure environments accelerates the stages of the software development lifecycle and compliments Microsoft Dev Box.
- Microsoft Learn: What is Azure Deployment Environments
- GitHub: Securing your end-to-end supply chain