Access to source code during application development must be restricted to authorized users.

From Test and Development Zone D Security Technical Implementation Guide

Part of ENTD0140 - Source code not restricted to authorized individuals.

Associated with IA controls: ECAN-1, ECCD-1, ECLP-1

SV-51477r1_rule Access to source code during application development must be restricted to authorized users.

Vulnerability discussion

Restricting access to source code and the application to authorized users will limit the risk of source code theft or other potential compromise.

Check content

Review the organization's site security plan and documentation to determine whether there is a list of current authorized users. If a current list of authorized users is missing from the site security plan for the test and development environment, this is a finding. If there isn't any application development occurring in the zone environment, this requirement is not applicable.

Fix text

Document all authorized users with access to the development environment and access to source code. If the documentation exists but is not current, bring the documentation up to date.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.