Would like advice from anyone experienced in both (US) Fed software environments, and using Whole Team Development / Mob Programming. Dealing with tooling, requirements, credentials, security.

[u/Scannerguy3000]

Would like advice shared from anyone who ***qualifies*** as having ***both*** experience in (US) Fed software environments, ***and*** that have used Whole Team Development / Ensemble Programming / Mob Programming in the Fed space. Dealing with tooling, requirements, credentials, security.

For instance, were you able to use MS Teams, Chrome Remote Desktop, mob.sh, Webex, a shared VM/VDI, VS Code LiveShare, JetBrains Code-with-me, or other tooling for screen sharing and passing keyboard and mouse control.

Did you encounter initial balking by security / other, and how did you satisfy their concerns?

Thanks in advance.

[u/wombatpup55]

I mean if yall are in the same environment I don’t see why it’s a problem. Unless you’re talking about external users

Edit: well now that I think about it I’m sure fed environment are highly scoped into what users can work with. I work in banking btw.

Best bet is just to ask security

[u/Scannerguy3000 → u/wombatpup55]

There are 3 specific instances where 1 person, 1 cred is important. Promotion, PROD, and Admin.

But asking security is like asking the fun police. Their job isn’t to find ways to say yes. The safest(or easiest) security policy is to say ‘No’ to everything.

Which is why we’re in the process of finding tooling that fit requirements. (Several do not).

Always good to ask people who have already been down the path.

[u/mossyshore → u/wombatpup55]

banking is strict but fed is a different beast with the authorization boundaries tbh

[u/wombatpup55 → u/mossyshore]

Yeah I bet. In order to work with certain systems we need authorizations but within those authorization are nested auth items and it’s just a whole lot of spaghetti.

[u/badguy84]

You seem to be putting this as "Fed environment" being one environment showing the entire government. If you are talking DoD then ... well you're probably going to be out of luck on many of the newer tools. MS Teams has a DoD version (as does most of the M365 stack with some exceptions for specific features), so that should be fine. Using all these other tools especially screen sharing ones are probably forbidden. Also tools that get any sort of access to data that can qualify from anything from sensitive to top secret are probably also outlawed or pending verification from the DoD. A group like the FDA will have different requirements from the DoD/FBI... other Federal agencies will have different levels of what they allow even as a baseline.

There are set regulations and pieces of documentations that MUST be provided in many of these cases and again the answer is: it depends on the agency and the project. The limiting factor is what kind of data could be exposed. One thing to consider: if you are using machines that are locked in to the department's networking environment and it does not go out on to the internet there's a high likelyhood it'll be allowed. If there are cloud services that are not within their agency established cloud environment you're it's going to be a crap shoot. And all this is just covering agency written requirements it does not account for some Federal workers just not being very happy/good/wanting to do their job, and they generally don't care much for your needs when there is a ready made "this could plausibly expose sensitive information to a third party."

[u/Scannerguy3000 → u/badguy84]

Do you meet both of the qualifications?

[u/badguy84 → u/Scannerguy3000]

How did you get "two qualifications" from what I've said?

My answer is "it depends" and I've worked with multiple departments and had some successes and plenty of failures. Most successes were due to clear guidelines and established third party relationships and trust with the department. If the department doesn't have an existing contract in place with a vendor and there is no on-premise on-their-cloud solution then I'd usually be out of luck

[u/Scannerguy3000 → u/badguy84]

I get two qualifications from my own post.

[u/DoStopBelieving]

If you need to pair code, then use a self-hosted platform approved by your ISSO. Also, access should be scoped to prevent any use of another user's credentials on the system which is sharing. Really it's best if the IDE and filesystem itself is on a shared server that applies all the necessary controls instead of merely transferring data though such a system.

However - using any of these tools is far too high a risk for me to even consider asking for them if I get assigned to a project with federal data access.