5 ms·

Indeed, if you are a security engineer, everything looks like a threat to you. Therefore, a developer's workstation must be protected just as strongly as a crit

Indeed, if you are a security engineer, everything looks like a threat to you. Therefore, a developer's workstation must be protected just as strongly as a critical database server - at the gross expense, of course, of the developer's productivity.

umvi 7y ago
Qualcomm is like this. Their developer workstations are ultra locked down. If you so much as plug in a flash drive, alarms will start going off. If you email them a file, any attachments are instantly quarentined. While I was there it was extremely difficult to transfer a log file from one of their workstations to my laptop for analysis during a debug session. It was also extremely difficult getting new builds into the setup since there was no easy way to get the binary file into their workstations.
- xorfish 7y ago
  I guess you could have used a private nextcloud instance to transfer it.
  - swinglock 7y ago
    I guess in such a locked down environment that would be grounds for termination.
    - xorfish 7y ago
      The point is more that all that "data loss prevention" stuff will not prevent someone who has access to the network to get data out.
arethuza 7y ago
I once worked somewhere as a contractor where developers had 3 separate PCs with a KVM switch - with there being separate development, test and production infrastructure. Ironically they had a serious production incident that almost took the entire (large) company out for a day because they were doing load testing in one environment (they had about 10 separate environments) but they had shared email infrastructure between production and the production-1 environment. The application being tested generated zillions of emails using "real" email addresses that clogged up their production environment.
- flir 7y ago
  My worst: Developer machines were dumb (but secure) terminals for remote desktop connections to a jump box, where a VNC connection got us to a Linux desktop living on AWS GovCloud where actual development took place. It was a remarkably risk-averse client.
BlueTemplar 7y ago
Isn't threat assessment (risk/mitigation cost) part of their job ?
blowski 7y ago
Precisely. Some folks over-estimate the security risks and under-estimate the business risks. Typically, the biggest risk to any organisation is going bankrupt, and doing "too much security" can make that more likely.

umvi 7y ago

Qualcomm is like this. Their developer workstations are ultra locked down. If you so much as plug in a flash drive, alarms will start going off. If you email them a file, any attachments are instantly quarentined. While I was there it was extremely difficult to transfer a log file from one of their workstations to my laptop for analysis during a debug session. It was also extremely difficult getting new builds into the setup since there was no easy way to get the binary file into their workstations.

xorfish 7y ago
I guess you could have used a private nextcloud instance to transfer it.
- swinglock 7y ago
  I guess in such a locked down environment that would be grounds for termination.
  - xorfish 7y ago
    The point is more that all that "data loss prevention" stuff will not prevent someone who has access to the network to get data out.

arethuza 7y ago

I once worked somewhere as a contractor where developers had 3 separate PCs with a KVM switch - with there being separate development, test and production infrastructure. Ironically they had a serious production incident that almost took the entire (large) company out for a day because they were doing load testing in one environment (they had about 10 separate environments) but they had shared email infrastructure between production and the production-1 environment. The application being tested generated zillions of emails using "real" email addresses that clogged up their production environment.

flir 7y ago
My worst: Developer machines were dumb (but secure) terminals for remote desktop connections to a jump box, where a VNC connection got us to a Linux desktop living on AWS GovCloud where actual development took place. It was a remarkably risk-averse client.

BlueTemplar 7y ago

Isn't threat assessment (risk/mitigation cost) part of their job ?

blowski 7y ago

Precisely. Some folks over-estimate the security risks and under-estimate the business risks. Typically, the biggest risk to any organisation is going bankrupt, and doing "too much security" can make that more likely.