I have a question more related to good standards of building and maintaining a toolbox that can be used on production machines. I'm currently part of support services team. We run into issues caused by the lack of tools available while working on our client production environment. The product is spread usually over 20 machines serving different purposes.
Below I'm listing issues we run into using a toolbox on production machines.
The tools can be forbidden by the company policies
In this case we need to be aware of the policies and find a tool replacement.
The client has to agree that we install the tool on their environment
This very often delays resolving an issue, as the client has to approve we install a tool. Sometimes given machine has to be restarted.
External sites are blocked and we are not able to download a tool from the internet location.
This protects the client system from threats, this is understandable. In such situation we build our own secure toolbox and make it available on our own trusted site, from which we can download it.
The caveat is that we won't be downloading the most recent set of tool versions and the toolbox would need to be maintained by us.
New versions of tools appear, therefore the toolbox needs maintenance
A process needs to be established to maintenance the toolbox monthly/weekly. It won't ensure that the toolbox is up-to-date at the time of using it on a production environment.
Tools may be vulnerable to attack, contain security holes
The approach here may be to investigate each of the tool before considering it safe. It's time consuming and it's possible that we won't find all the issues related to given tool.
Now few questions from me.
There is a service as www.ninite.com. Can it be considered as safe for production environments? Ninite may also not be trusted by the client, therefore blocked by their site blocking software.
Given the above - what kind of guidelines would you give to people who intend to use a proven, safe set of tools on a production environment and mitigate the risk of exposing the client environment to threats?
What kind of other problems worth knowing of you run into?
Do you you see how to ensure that the tool is safe and trusted?
Are there any kind of authorities capable for certifying a tool built by someone?
Can the portable apps (www.portableapps.com) considered as safe on production environments, in terms of threats?