Ephemeral Environments And Security

Ephemeral Environments And Security

Intrinsically, staging environments are not meant for wide audiences. Regardless of best practices, your staging environments will often contain confidential or internal information. They are best-suited for testing features across your team; they are not meant to be seen by end-users. By following a few general rules and suggestions, you can implement a few layers of security to ensure all your environments are accessed solely by your team and any trusted visitors. Remember to:

Use SSO or a VPN

SSO and VPNs are good solutions when trying to access private environments and areas. By integrating with a straightforward authentication system, you can add a secure gateway to your ephemeral environments. Using SSO or a VPN will:

Sanitize Your Data

It is crucial to exclude any Personally Identifiable Information (PII) from your ephemeral environments. Keeping PII secure is the responsibility of the DevOps and SRE teams. For more information on PII, check out popular regulatory frameworks, such as PCI DSS and SOC 2. Keeping your data sanitized means:

Content Contributors

nbeck415 on GitHub
bueller on GitHub