2

I have a concern I would like the input of the software developer community, but can't decide where to post it.

Basically, I'm wondering how to handle developing software when data security of the clients I work for is a serious concern.

Here's a draft of the question:

Nowadays, developing software involves downloading un-vetted, open-source libraries (npm, nuget, jars in general) that could do... well, anything when on your system and executed in your project/IDE.

So when I have sensitive data on the same machine it is potentially endangered. Hence the problem of how to handle this generally when developing modern software while having potentially data on your machine that needs to be secured from leaking.

I can imagine that you'd have one developing machine and one data machine on separate networks, and the developer needs to switch between them depending on what they need to do. But this will immedately fail if you need test data while developing. Because moving that to the "unsecure" machine will also make the data unsecure.

Another idea would be to completely lock down "pushing" from the developer machine, so it can only download from the internet but never push (or only on very specific ports to very specific IPs. But I can see this approach to become a management nightmare.

So, I'm looking for any well-known approaches to developing software using external, inherently unsecure, resources (like npm libs or unvetted IDEs, plugins, etc.) in regards to sensitive data that must not be leaked to nefarious sources?

I feel this should be a good question for SE.SE but it could also "bleed" to security.SE or even law.SE...

What do you think? Where sould I post this?

1

1 Answer 1

Reset to default
3

What, exactly, are you looking for in answers? What is your specific question?

The problem with the block that you posted is that it doesn't ask a question. I would think that it would be closed as "unclear what you are asking" or "too broad" on any SE site.

If you are looking for tools to automate the processes related to security audits, then that would go to Software Recommendations, but they have very specific rules about how to formulate a good question.

If you are asking about how to incorporate processes around security into your development lifecycle, that would be OK here and I suspect on Information Security as well, but both have rules around asking specific, answerable questions and avoiding extended discussions. The sample that you posted doesn't seem to contain a specific, answerable question.

If you have a very specific question, we can probably be more specific in providing guidance as to where to go to ask it.

5
  • The block was not supposed to be the question itself, it was just to outline the topic. I can try to formulate a specific question here so we might find out if and where I could post it.
    – F.P
    Nov 8, 2017 at 10:08
  • @Florian I hope my general guidance was helpful. But if you do want specific guidance, a specific question to talk about is necessary. Please leave a comment here if/when you edit the question and I'll take another look.
    – Thomas Owens Mod
    Nov 8, 2017 at 10:13
  • I updated a draft... While writing I realized that maybe this will be more suited for a forum because I guess it's not definitely answerable, or rather too broad for SE in general
    – F.P
    Nov 8, 2017 at 10:39
  • 2
    @FlorianPeschka Yeah - the current form looks overly broad for SE. It's definitely an interesting problem space, though.
    – Thomas Owens Mod
    Nov 8, 2017 at 11:10
  • I thought so, OK. you wouldn't have some forum in mind where this might be a good topic? I not, I'll just search around for something appropriate
    – F.P
    Nov 8, 2017 at 11:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .