CIS Controls CIS-16.8

Separating production and non-production environments with enforced network and administrative boundaries can restrict non-production systems and management paths from reaching production identity infrastructure, reducing opportunities to modify production accounts or authentication settings.

Separate production cloud environments, VPCs, and control-plane access paths can prevent non-production systems or administrators from reaching production identity interfaces used to add cloud credentials to existing accounts.

Network separation between production and non-production environments limits the infrastructure and traffic paths visible from either environment, reducing the scope in which an adversary can position for interception or manipulation of communications.

Separating production and non-production broadcast, name-resolution, and SMB communication paths can constrain poisoning activity and prevent non-production systems from directly relaying authentication to production services.

Production and non-production container or virtualization infrastructure can be placed behind separate gateways, firewalls, or control-plane boundaries so a compromised non-production system cannot directly reach production hosts used to build images.

Separating production and non-production container control planes and network paths can prevent a compromised non-production workload from directly querying production container APIs, dashboards, nodes, or resource inventories.

Enforced separation can restrict access from non-production systems and administrative paths to production account-management infrastructure, reducing the ability to create accounts in the production environment from a compromised non-production environment.

Production domain controllers and account-management services can be isolated from non-production networks so non-production systems cannot directly reach the services used to create or manage production domain accounts.

Separate production cloud environments and restricted control-plane connectivity can limit non-production access to production identity services used to create cloud accounts.

Production configuration-management interfaces and repositories can be placed on network or management segments that are not directly reachable from non-production systems, reducing unauthorized collection of production configuration data.

Separating production management traffic from non-production networks can restrict SNMP access to approved production management systems and prevent non-production hosts from directly querying production MIB data.

Production network-device management interfaces can be isolated from non-production environments so non-production systems cannot directly access SNMP, Smart Install, or other interfaces used to retrieve production device configurations.

Separating production from non-production systems reduces unauthorized cross-environment access to production data and business processes, limiting the ability of a compromise in development or test infrastructure to directly manipulate production information.

Enforced production boundaries can prevent non-production systems from directly reaching production applications and runtime services, reducing opportunities to alter data while it is being processed in the production environment.

Separate production and non-production container control planes can prevent compromised non-production systems from directly accessing production APIs or orchestrators used to deploy containers.

Separating sensitive production identity infrastructure from non-production networks can restrict the connectivity required for systems in non-production environments to enumerate production domains and trust relationships.

Firewalls and access controls between production and non-production environments can permit only required protocols and destinations, blocking unauthorized alternate-protocol transfers across the production boundary.

Production/non-production boundary controls can deny unapproved encrypted protocols, ports, and destinations, limiting exfiltration over symmetrically encrypted non-command-and-control channels across environments.

Production/non-production boundary controls can restrict unapproved encrypted protocols and destinations, limiting exfiltration over asymmetrically encrypted non-command-and-control channels across environments.

Production/non-production segmentation can block unnecessary plaintext protocols and destinations across the environment boundary, directly restricting unencrypted non-command-and-control exfiltration paths.

Production services can be placed on separate hosting or security zones from non-production systems so exploitation of an exposed application does not provide unrestricted network reachability into other production resources.

Separating production and non-production systems with controlled network paths reduces the remote services reachable across environments and limits exploitation-based movement from a compromised non-production system into production.

Production remote-access services can be exposed only through dedicated gateways, proxies, or approved access paths that are separate from non-production access, preventing direct remote connectivity from less-trusted environments into production.

Network segmentation between production and non-production systems limits host and service reachability, reducing the production systems that can be discovered from a compromised development or test environment.

Separating production and non-production network segments limits the traffic, broadcasts, and multicast communications visible from either environment, reducing opportunities to capture production traffic from non-production systems.

Production/non-production firewalls and gateways can restrict communication to approved interfaces and protocols, blocking unauthorized non-application-layer traffic across the environment boundary.

Boundary firewalls between production and non-production environments can allow only explicitly required ports, preventing arbitrary cross-environment communication over non-standard or unauthorized ports.

Restricting remote-service traffic between production and non-production security zones reduces the ability of an adversary in one environment to reach and hijack remote sessions in the other.

Blocking unnecessary RDP traffic between production and non-production environments prevents non-production systems from directly reaching production RDP sessions that could otherwise be hijacked.

Production/non-production segmentation can restrict RDP to explicitly approved administrative paths and block ordinary cross-environment RDP connectivity.

Firewall rules between production and non-production environments can restrict DCOM and RPC connectivity, reducing opportunities for remote DCOM execution across the environment boundary.

Production systems can use separate WinRM management paths and firewall rules that permit access only from approved administrative systems, preventing general non-production systems from reaching production WinRM services.

Separating production systems and supporting security or response infrastructure from non-production networks can reduce the ability of an adversary who compromises non-production systems to reach and stop critical production or defensive services.

Production deployment and management infrastructure can be isolated from non-production systems and reachable only through approved administrative paths, reducing the ability to abuse a compromised non-production deployment tool to execute software in production.

Separating production and non-production environments prevents a trusted integration or relationship available in a less-restricted non-production environment from automatically providing equivalent network reachability into production.

Production container APIs can be isolated behind separate gateways, firewalls, or control-plane networks so non-production workloads cannot directly access production container interfaces that may expose credentials or sensitive configuration.

Where non-production or general wireless access is separated from production network segments, enforced segmentation prevents systems that gain Wi-Fi connectivity from directly reaching sensitive production resources.