SSH: Best practices
Developer laptop compromise is probably the biggest security risk that any startup company faces, because the developer laptop is an uncontrolled environment with a lot of &quot;attack surface&quot; which may have been previously compromised.<p>In my view there are emerging best practices in this area.  There are two ways to reduce this risk and both are controversial:<p>1.  Force developers to only develop software using an SSH terminal (by first connecting to a developer VPN via 2FA and then sshing into their secure development environment where may use tools like tmux, vi, and their programming language of choice to get the job done).  In this scheme copying source codes or security credentials to a developer laptop is considered a violation and becomes a fireable offense no questions asked.<p>2. Require all developers to run a private USB-bootable linux desktop shell which is known to be clean.  In this case they remain free to utilize modern desktop editors and code emulators (such as android simulator).  It&#x27;s even possible to setup secure persistence in these environments so that the developer&#x27;s browser configuration, network&#x2F;vpn config, dotfiles, apt installs, etc are stored on an encrypted filesystem on USB device.  The reason why a USB image is preferred is because it&#x27;s annoying to ask a new employee to repartiation her personal harddrive.<p>My suspicion is that as more of the tools developers need to rely on are cloud-based: (example: github, cloud9, jenkins, etc) we will eventually see these modern best practices against client-side attacks being adopted more broadly.  The quality and reliability of hot-bootable ultra secure cloud operating systems has gone thru the roof over the past couple of years and I assume this trend will only accellerate due to the fact that Google Chrome OS continues to penerate more of the market and consumers are getting used to it.<p>TLDR: ssh keys existing on developer harddrives is an info-sec anti-pattern, they should only ever exist in system memory or in an encrypted partition on a USB stick.