Belajar QA Tester - Secure Test Environments

#Pendahuluan

Setelah di episode 18 kita mempelajari data privacy in testing, pada episode ini kita mempelajari secure test environments — bagaimana mengamankan test environments dari unauthorized access. Test environment yang tidak aman bisa menjadi target attack dan membahayakan data sensitif.

Mengapa secure test environments penting? Karena test environment sering dianggap "kurang penting" dibanding production, padahal bisa mengandung data sensitif dan akses ke sistem production. Test environment yang bocor bisa menjadi entry point untuk attack ke production.

#Isolasi Environment

#Environment Segmentation

text

Environment Segmentation:
├── Development:
│   ├── Local machine developer
│   ├── Data fake/test
│   └── No production data
├── Testing/QA:
│   ├── Isolated network
│   ├── Data masked/synthetic
│   └── Limited access
├── Staging:
│   ├── Mirrors production
│   ├── Data production-like (masked)
│   └── Controlled access
└── Production:
    ├── Fully isolated
    ├── Real data
    └── Strict access control

#Network Isolation

text

Network Security:
├── VPN: Akses test environment via VPN
├── Firewall: Block unauthorized IP
├── VPC: Isolate environment di cloud
├── Zero Trust: Verify setiap akses
└── Monitoring: Log semua akses

#Secrets Management

#Contoh Secrets

text

Secrets yang Harus Di-manage:
├── API Keys
├── Database credentials
├── Encryption keys
├── Service account passwords
├── TLS certificates
└── JWT signing keys

#Tools untuk Secrets Management

text

Secrets Management Tools:
├── Environment Variables:
│   ├── .env files (development only)
│   └── Never commit ke repository
├── Vault (HashiCorp):
│   ├── Centralized secrets storage
│   ├── Dynamic secrets
│   └── Audit trail
├── AWS Secrets Manager:
│   ├── Managed service
│   ├── Auto rotation
│   └── Integration dengan AWS
└── .env.example:
    ├── Template untuk developers
    ├── No actual values
    └── Document required secrets

#Best Practices

text

Secrets Best Practices:
├── 1. Never commit secrets ke repository
│   └── Gunakan .gitignore
├── 2. Use environment variables
│   └──export API_KEY=xxx
├── 3. Rotate secrets regularly
│   └── Set expiration
├── 4. Limit access
│   └── Least privilege principle
├── 5. Monitor usage
│   └── Audit trail
└── 6. Use different secrets per environment
    └── Dev, staging, production

Note

Jangan pernah hardcode secrets di source code atau test scripts. Gunakan environment variables atau secrets management tools. Ini mencegah secrets bocor ke repository public.

#Test Accounts

#Test Account Strategy

text

Test Accounts:
├── Shared test accounts:
│   ├── QA team shared
│   ├── Fixed credentials
│   └── Regular password change
├── Individual test accounts:
│   ├── Per tester
│   ├── Unique credentials
│   └── Personal responsibility
├── Service accounts:
│   ├── Untuk automation
│   ├── Limited permissions
│   └── Rotation policy
└── Cleanup policy:
    ├── Delete unused accounts
    ├── Rotate passwords regularly
    └── Audit account usage

#Practical: Secure Environment Checklist

yaml

secure_env_checklist:
  isolation:
    - separate_network
    - vpn_required
    - firewall_rules
    - no_direct_internet
  secrets:
    - no_hardcoded_secrets
    - environment_variables
    - secrets_management_tool
    - regular_rotation
  access:
    - least_privilege
    - mfa_enabled
    - access_logging
    - regular_audit
  monitoring:
    - access_logs
    - anomaly_detection
    - alert_on_suspicious
    - regular_review

Tip

Test environment harus treatment yang sama dengan production dari sisi security. Jangan biarkan test environment menjadi "backdoor" ke sistem kalian.

#Penutup

Pada episode 19 ini, kalian telah mempelajari secure test environments.

Inti yang harus dibawa pulang:

Isolasi environment: development, testing, staging, production terpisah.
Secrets management: gunakan env vars atau vault, jangan hardcode.
Test accounts: strategy terstruktur dengan cleanup policy.
Monitoring: log semua akses, detect anomalies.

Di episode 20 selanjutnya, kita akan membahas test evidence & audit — bagaimana mendokumentasikan test evidence untuk compliance dan audit. Sampai jumpa di episode 20!