Information Security Handbook

Step 3: Integrating secure configuration baselines into the SDLC

The information security program should work with business and IT stakeholders to ensure that secure configuration guidance is established throughout the SDLC life cycle for all information system environments, including:

• Development: Development environments tend to have more freedom so that experimentation and creativity can be fostered. As a result, many security vulnerabilities exist.

Ensure that you protect your other information systems from your development environments and that you do not allow your development system to be inadvertently accessed from external parties.

Development systems often contain extensive intellectual property and need to be well protected. ...