How to protect my Confluence instance

[Jurij Ivastsuk-Kienbaum]

Hello,
I would like to protect my Confluence instance from attacks from the Internet. What do you think should be done to achieve this?

Thanks!

[Sagar Mahajan · Accepted solution]

Hi @Jurij Ivastsuk-Kienbaum You can follow the below best practices to make your Confluence instance secure.

1. If you do not require your Confluence to be accessible publicly and only your company is used it then run the application under your company VPN so that public users should not be able to access the instance.

2, If Confluence is also used by public users then use the WAF solutions like Akamai, Cloudflare, etc to protest your application from the external attackers.

3. Always keep the Secure administrator sessions enable in your site from the Security Configuration so that admins will need to re-authenticate while accessing the admins configuration.

4. Always keep watch on the Atlassian security news for the CVE reported by the Atlassian and mitigating steps need to be taken

https://www.atlassian.com/trust/security/advisories

5. Have your applications running on the latest or closed to latest version so that security improvements added by Atlassian are always intact.

6. If you have internal security team then have them run regular audits against the application from UI and backend server so that there should not be any loophole.

7. Make sure all your lower instances like Stage/Devel/Pre-Prod are running internal to your network and have similar configuration as that of production to aviod any security issues and keep them aligned with your prod version.

8. Have minimum number of admins users in your application based on the size of your organization not more than 5-10 admins per site.

These are some basic but important things to remember to avoid any security issues

Thanks

Sagar

[Jurij Ivastsuk-Kienbaum]

Thank you Sagar!

[Stu Lees ️ REVYZ]

Great advice @Sagar 

[Fabio Racobaldo _Herzum_ · Accepted solution]

Hi @Jurij Ivastsuk-Kienbaum ,

please take a look to the following article https://confluence.atlassian.com/doc/confluence-security-overview-and-advisories-134526.html

My suggestion is to monitor security advisor.

To be notified by email when new advisories or bulletins are published go to https://my.atlassian.com/email and subscribe to Tech Alerts emails.

Hope this helps,

Fabio

[Jurij Ivastsuk-Kienbaum]

Thank you Fabio!

[Fabio Racobaldo _Herzum_]

you're welcome @Jurij Ivastsuk-Kienbaum 

[Stu Lees ️ REVYZ]

Hi @Jurij Ivastsuk-Kienbaum , there are already some great answers here so here are a few points to top up the existing advice...


1.  Cloud risks are evolving, so make it your mission to stay up to date with advisories and knowledge about the ever-changing cyber threat landscape.  As the threats are not static, thus there is no static solution to best practice protection.   

2.  End user training of cyber risks, threats need to happen.  Just recently a major global toy manufacturer had their CFO *nearly* duped by a realtime video call fake of the CEO using A.I. to mimic their appearance and voice and to ask the CFO to transfer funds.  Your end users need to be kept as up to date as you are to ensure that you don't suffer from advanced social engineering attacks.

3.  The security practice that is most often overlooked is to have an independently managed and stored data backup solution so that if you site or network gets hacked, the hackers cannot EVER access your prestine copies of data backup.  This is an easy practice using marketplaces products such as Revyz and mitigate the impact of many attacks such as malware, ransom attacks and rogue employees. 

4.  Work with expert solution partners to externally assess and review your security.  Security is an area that you want to have a budget to constantly improving so as to stay ahead of the evolving risks.

If you want to keep up to date with this stuff, we build a Cloud Resource Center for Jira (and Confluence on our website which we regularly update with videos, interviews, whitepapers and a variety of resources for Jira and Confluence admins.  Check it out here