Question
An organization is working to secure its development process to ensure developers cannot deploy artifacts directly into the production environment. Which of the following security practice recommendations would be the best to accomplish this objective?
- A. Implement least privilege access to all systems.
- B. Roll out security awareness training for all users.
- C. Set up policies and systems with separation of duties. Correct
- D. Enforce job rotations for all developers and administrators.
- E. Utilize mandatory vacations for all developers.
- F. Review all access to production systems on a quarterly basis.
Explanation
Separation of duties splits writing code from releasing it, so a developer cannot push their own artifacts into production without another role (release or operations) approving and deploying them. Least privilege helps but does not by itself define the split between development and deployment roles. Training, job rotation, mandatory vacations and quarterly access reviews are detective or administrative measures that do not stop a direct deployment.
