Production data in testing is still common, and Tricentis’ CISO wants it gone
Overview
Erika Dean, the Chief Information Security Officer at Tricentis, is advocating for the removal of production data from testing environments. She argues that with the current alternatives available, it’s no longer necessary to use real data in tests, which can pose security risks. During an interview, Dean shared how her team identified a significant security gap related to prompt injection during a red-teaming exercise, leading them to delay a software release by a week until the issue was resolved. She also discussed the criteria that lead to rejecting AI vendors, particularly when they provide vague information about data storage and retention practices. This conversation emphasizes the need for more stringent data handling practices in software development.
Key Takeaways
- Affected Systems: Tricentis software development environments
- Action Required: Implement best practices for data handling in testing environments and ensure clear data retention policies from vendors.
- Timeline: Ongoing since recent discussions
Original Article Summary
In this Help Net Security interview, Erika Dean, CISO at Tricentis, talks about keeping production data out of test environments and why she thinks the alternatives are good enough now. She explains how her team caught a prompt injection gap in red-teaming and held a release for a week until it was fixed. Dean describes what gets an AI vendor rejected, mostly vague answers about where data lives and how long it is kept. She … More → The post Production data in testing is still common, and Tricentis’ CISO wants it gone appeared first on Help Net Security.
Impact
Tricentis software development environments
Exploitation Status
No active exploitation has been reported at this time. However, organizations should still apply patches promptly as proof-of-concept code may exist.
Timeline
Ongoing since recent discussions
Remediation
Implement best practices for data handling in testing environments and ensure clear data retention policies from vendors.
Additional Information
This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.