-3

We want our developers to be able to diagnose production issues in staging. For the sake of this, we are planning to make an exact replica of production into staging. We are thinking however, if we scrub the non-encrypted data, that it could no longer represent issues that may be present in production.

What is the best practice in this situation? Should they have full read access to staging? Should it be scrubbed? How should the staging environment be implemented for customer security but also to allow developers to diagnose production issues?

2
  • 1
    Building a system that allows testing and diagnosing problems without revealing production data to developers will likely be possible but it will be time consuming and expensive. A non-disclosure agreement is a lot cheaper. What will be done depends on the case, the budget and the people who choose. Mar 4 at 21:01
  • 1
    And on your laws.
    – gnasher729
    Mar 5 at 12:52

1 Answer 1

4

There are conflicting forces in play, and it is up to your organization to find a viable compromise. In practice, accessing the real system may be the only possible way of diagnosing the problem.

As a developer, I consider myself trustworthy (of course) and it's part of my work ethics (apart of my contractual obligations) to keep confidentiality about data that I happen to see during my work.

If you don't trust your devs, you will have to live with the fact that some errors will not be diagnosed correctly because they can only guess based on unreliable user reports and non-representative data.

A reasonable compromise might be to give time-limited access to (maybe a partial and anonymized copy of) production data for the purpose of analyzing an issue, but creating such a copy might itself require the work of a developer unless it's not already coded upfront.

1
  • 1
    Another thing to consider is which legal frameworks or laws apply to the data in the system. This can mandate data be scrubbed and provided to a lower level environment. Mar 5 at 11:56

Not the answer you're looking for? Browse other questions tagged or ask your own question.