2023-18 – Improper separation of DTAP environments
| Veld | Waarde |
|---|---|
| Status | Actief |
| Behandeling | Accepteren |
| Kans | Laag |
| Impact | Hoog |
| Blootstelling | Midden |
| Restblootstelling | Laag |
| Eigenaar | Management |
| Verantwoordelijke | Security Officer |
Asset
Confidential information on production systems
Dreiging
- Developers and testers have access to confidential customer data 2. Software is put into production without proper testing 3. Inadvertent deletion of data
Risicocategorie
Vertrouwelijkheid, Integriteit, Beschikbaarheid
Risicoscore
| Kans | Impact | Blootstelling | Restblootstelling |
|---|---|---|---|
| Laag | Hoog | Midden | Laag |
Behandelingsmaatregelen
- Separate development, testing, acceptation and production environments (A.8.31 Separation of development, test and production environments)
- Limit the access to production environments to certain roles (A.5.3 Segregation of duties)