Contents
Do you use production data in your test environment?
Avoid using real (production) data in your test environments, and sanitize it if you must. It can be challenging to simulate real-world conditions in test environments, especially when debugging complex issues that depend on large datasets to replicate. For this reason, production data is sometimes loaded into test environments.
Why are test environments disconnected from production environments?
These “non-production”, or test environments should ideally be completely disconnected from production environments to prevent security incidents and bugs. In fact typically, a company’s test environments are only known about internally and not at all revealed to the public.
Is it safe to use test credentials in production?
Test environments should always use different credentials from production, so that even if leaked, test credentials simply cannot be used to access production. Test credentials should follow the principle of least privilege, so attackers could only use test credentials to have limited access to your test environment and nothing else.
Why do you need test and Dev data?
Valuable Test and Dev data is data that’s readily available ‘ allowing teams to work on patches and fixes the moment it’s clear something’s wrong. Here’s the good news.
Can you re-process production data for ulterior purpose?
We’ve determined how re-processing raw production data for an ulterior purpose, in this case, for database testing, is a non-starter in the context of GDPR, but can anything be done to mitigate the requirement and/or provide some workarounds? GDPR explicitly encourages and recommends the obfuscation of data.
Is it bad to expose credentials to test environments?
However, in our security research, we often find exposed credentials to test environments, which can lead to far more serious consequences. Despite not being associated with production environments, test credentials should be protected as if they did.