Information
Data export from production databases may include sensitive data. Application developers may not be cleared for or have need-to-know to sensitive data. Any access they may have to production data would be considered unauthorized access and subject the sensitive data to unlawful or unauthorized disclosure.
NOTE: Nessus did not perform this check as it requires manual verification.
Solution
Develop, document and implement policy and procedures that provide restrictions for production data export.
Require users and administrators assigned privileges that allow the export of production data from a production database to acknowledge understanding of export restrictions.
Restrict permissions allowing use or access to database export procedures or functions to authorized users.
Ensure sensitive data from production is sanitized prior to import to a development database (See check DG0076).
Grant access and need-to-know to developers where allowed by policy.