Access control lists between development and testing network segments within a test and development environment must be in a deny-by-default posture.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-39662	ENTD0230	SV-51529r1_rule	ECSC-1	Low

Description
To prevent malicious or accidental leakage of information between test and development environments, organizations must implement a deny-by-default security posture. All traffic not explicitly permitted must be denied. Such rule sets prevent many malicious exploits or accidental leakage by regulating the ports, protocols, or services necessary between network segments within the test and development environment.

Description

To prevent malicious or accidental leakage of information between test and development environments, organizations must implement a deny-by-default security posture. All traffic not explicitly permitted must be denied. Such rule sets prevent many malicious exploits or accidental leakage by regulating the ports, protocols, or services necessary between network segments within the test and development environment.

STIG	Date
Test and Development Zone A Security Technical Implementation Guide	2018-09-17

Details

Check Text ( C-46817r1_chk )
Determine whether a deny-by-default security posture has been implemented for both ingress and egress traffic for the test and development environment. If the organization is not using a deny-by-default security posture for ingress and ingress traffic for the test and development environment, this is a finding.

Fix Text (F-44670r1_fix)
Implement a deny-by-default security posture for both ingress and egress traffic between network segments in the test and development environment.