CIS-16.8 Separate Production and Non-Production Systems

• T1021.001 Remote Desktop Protocol — Production/non-production segmentation can restrict RDP to explicitly approved administrative paths and block ordinary cross-environment RDP connectivity. • T1021.003 Distributed Component Object Model — Firewall rules between production and non-production environments can restrict DCOM and RPC connectivity, reducing opportunities for remote DCOM execution across the environment boundary. • T1021.006 Windows Remote Management — Production systems can use separate WinRM management paths and firewall rules that permit access only from approved administrative systems, preventing general non-production systems from reaching production WinRM services. • T1040 Network Sniffing — Separating production and non-production network segments limits the traffic, broadcasts, and multicast communications visible from either environment, reducing opportunities to capture production traffic from non-production systems. • T1046 Network Service Discovery — Network segmentation between production and non-production systems limits host and service reachability, reducing the production systems that can be discovered from a compromised development or test environment. • T1048 Exfiltration Over Alternative Protocol — Firewalls and access controls between production and non-production environments can permit only required protocols and destinations, blocking unauthorized alternate-protocol transfers across the production boundary. • T1048.001 Exfiltration Over Symmetric Encrypted Non-C2 Protocol — Production/non-production boundary controls can deny unapproved encrypted protocols, ports, and destinations, limiting exfiltration over symmetrically encrypted non-command-and-control channels across environments. • T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol — Production/non-production boundary controls can restrict unapproved encrypted protocols and destinations, limiting exfiltration over asymmetrically encrypted non-command-and-control channels across environments. • T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol — Production/non-production segmentation can block unnecessary plaintext protocols and destinations across the environment boundary, directly restricting unencrypted non-command-and-control exfiltration paths. • T1072 Software Deployment Tools — Production deployment and management infrastructure can be isolated from non-production systems and reachable only through approved administrative paths, reducing the ability to abuse a compromised non-production deployment tool to execute software in production. • T1095 Non-Application Layer Protocol — Production/non-production firewalls and gateways can restrict communication to approved interfaces and protocols, blocking unauthorized non-application-layer traffic across the environment boundary. • T1098 Account Manipulation — Separating production and non-production environments with enforced network and administrative boundaries can restrict non-production systems and management paths from reaching production identity infrastructure, reducing opportunities to modify production accounts or authentication settings. • T1098.001 Additional Cloud Credentials — Separate production cloud environments, VPCs, and control-plane access paths can prevent non-production systems or administrators from reaching production identity interfaces used to add cloud credentials to existing accounts. • T1133 External Remote Services — Production remote-access services can be exposed only through dedicated gateways, proxies, or approved access paths that are separate from non-production access, preventing direct remote connectivity from less-trusted environments into production. • T1136 Create Account — Enforced separation can restrict access from non-production systems and administrative paths to production account-management infrastructure, reducing the ability to create accounts in the production environment from a compromised non-production environment. • T1136.002 Domain Account — Production domain controllers and account-management services can be isolated from non-production networks so non-production systems cannot directly reach the services used to create or manage production domain accounts. • T1136.003 Cloud Account — Separate production cloud environments and restricted control-plane connectivity can limit non-production access to production identity services used to create cloud accounts. • T1190 Exploit Public-Facing Application — Production services can be placed on separate hosting or security zones from non-production systems so exploitation of an exposed application does not provide unrestricted network reachability into other production resources. • T1199 Trusted Relationship — Separating production and non-production environments prevents a trusted integration or relationship available in a less-restricted non-production environment from automatically providing equivalent network reachability into production. • T1210 Exploitation of Remote Services — Separating production and non-production systems with controlled network paths reduces the remote services reachable across environments and limits exploitation-based movement from a compromised non-production system into production. • T1482 Domain Trust Discovery — Separating sensitive production identity infrastructure from non-production networks can restrict the connectivity required for systems in non-production environments to enumerate production domains and trust relationships. • T1489 Service Stop — Separating production systems and supporting security or response infrastructure from non-production networks can reduce the ability of an adversary who compromises non-production systems to reach and stop critical production or defensive services. • T1552.007 Container API — Production container APIs can be isolated behind separate gateways, firewalls, or control-plane networks so non-production workloads cannot directly access production container interfaces that may expose credentials or sensitive configuration. • T1557 Adversary-in-the-Middle — Network separation between production and non-production environments limits the infrastructure and traffic paths visible from either environment, reducing the scope in which an adversary can position for interception or manipulation of communications. • T1557.001 Name Resolution Poisoning and SMB Relay — Separating production and non-production broadcast, name-resolution, and SMB communication paths can constrain poisoning activity and prevent non-production systems from directly relaying authentication to production services. • T1563 Remote Service Session Hijacking — Restricting remote-service traffic between production and non-production security zones reduces the ability of an adversary in one environment to reach and hijack remote sessions in the other. • T1563.002 RDP Hijacking — Blocking unnecessary RDP traffic between production and non-production environments prevents non-production systems from directly reaching production RDP sessions that could otherwise be hijacked. • T1565 Data Manipulation — Separating production from non-production systems reduces unauthorized cross-environment access to production data and business processes, limiting the ability of a compromise in development or test infrastructure to directly manipulate production information. • T1565.003 Runtime Data Manipulation — Enforced production boundaries can prevent non-production systems from directly reaching production applications and runtime services, reducing opportunities to alter data while it is being processed in the production environment. • T1571 Non-Standard Port — Boundary firewalls between production and non-production environments can allow only explicitly required ports, preventing arbitrary cross-environment communication over non-standard or unauthorized ports. • T1602 Data from Configuration Repository — Production configuration-management interfaces and repositories can be placed on network or management segments that are not directly reachable from non-production systems, reducing unauthorized collection of production configuration data. • T1602.001 SNMP (MIB Dump) — Separating production management traffic from non-production networks can restrict SNMP access to approved production management systems and prevent non-production hosts from directly querying production MIB data. • T1602.002 Network Device Configuration Dump — Production network-device management interfaces can be isolated from non-production environments so non-production systems cannot directly access SNMP, Smart Install, or other interfaces used to retrieve production device configurations. • T1610 Deploy Container — Separate production and non-production container control planes can prevent compromised non-production systems from directly accessing production APIs or orchestrators used to deploy containers. • T1612 Build Image on Host — Production and non-production container or virtualization infrastructure can be placed behind separate gateways, firewalls, or control-plane boundaries so a compromised non-production system cannot directly reach production hosts used to build images. • T1613 Container and Resource Discovery — Separating production and non-production container control planes and network paths can prevent a compromised non-production workload from directly querying production container APIs, dashboards, nodes, or resource inventories. • T1669 Wi-Fi Networks — Where non-production or general wireless access is separated from production network segments, enforced segmentation prevents systems that gain Wi-Fi connectivity from directly reaching sensitive production resources.