Re: using live Production as sandbox for training

[Theresa Semmens <theresa.semmens () NDSU EDU>]

Using a live production environment for a training area (aka sandbox) is not
sound business practice. The software development life cycle process is
clear in stating that there needs to be distinct separation of live
production and sandbox training. I would be very concerned about using live
production data for training/testing purposes - how will you know that data
has maintained the integrity, confidentiality, and availability required in
a trustworthy environment. It's just my two cents worth. :-)


Theresa Semmens, CISA
NDSU IT Security Officer
PO Box 5164
North Dakota State University
Fargo, ND
Phone: 701-231-5870
FAX: 701-231-8541
Theresa.Semmens () ndsu edu

"Opportunity is missed by most people because it is dressed in overalls and
looks like work."  Thomas Edison

-----Original Message-----
From: The EDUCAUSE Security Constituent Group Listserv
[mailto:SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of Cal Frye
Sent: Friday, May 30, 2008 9:49 AM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: Re: [SECURITY] using live Production as sandbox for training

Melissa wrote:
> Can anyone provide ANY insight as to the pros and cons of using a live
> production system for training instead of creating a seperate sandbox
> environment?

Well, if you were hoping to use your trainees as data-entry clerks for
the period...

Practically, I suppose it might be tempting to use the production
environment if it were costly in time or systems to create the sandbox,
but this could be risky, as I suspect you already know ;-)

I could see a situation where a DR system could be dual-purposed for
training functions in addition, if the hardware costs are great.

--
Regards,
-- Cal Frye, Network Administrator, Oberlin College

    www.calfrye.com,  www.pitalabs.com


"Every hour I live I become an intenser devotee to common sense!"
--Alice James.