A security engineer is designing a system in which offshore, outsourced staff can push code from the development environment to the production environment securely. The security engineer is…

A VDI environment with copy-paste restrictions reduces exfiltration channels but still provisions offshore staff with a persistent virtual machine that holds direct access to development systems, maintaining a larger attack surface than a collaboration-only session where no persistent access is granted.

Installing a client-side VPN on staff laptops grants offshore staff direct, persistent network-level access to the development environment from personally managed devices outside corporate control, creating significant data exfiltration risk with no endpoint enforcement.

An IPSec tunnel between the offshore office network and the corporate development network creates a persistent, broad network path for all offshore staff, providing no granular data loss controls and exposing internal resources to any endpoint on that remote network.

By using screen-sharing or collaborative session tools, offshore staff interact visually with a local employee's workstation where production credentials and data already reside under corporate control - sensitive code and data never transfer to offshore-controlled endpoints, satisfying the data loss prevention requirement without adding approval queues or access delays that would slow the development pipeline.