JIRA Server - security best practice

[Andrew Henders]

Hello,

I'm running JIRA Software & Service Desk on the same server and am looking at creating a JIRA Service Desk Project that will allow public sign-up.

JIRA Internal Directory is in use.

I'm wanting to mitigate the risk of a public customer being accidentally assigned to a JIRA Group that would give them access to our internal Software and Business projects.

Any suggestions or experiences appreciated.

Thanks,

Andrew

[Nic Brough -Adaptavist- · Accepted solution]

Putting a person in the wrong group is nothing you can mitigate against in software.  A human chose to put them in the wrong group, the human should not have done that.  The computers can only do what they're told.

The suggestions are all around process - record and audit all requests for user changes.  Lock it down where you can (although there's not a lot you can do with the internal directory - you have to trust your admins to get it right).  Regularly report on permissions and who has them.  And make sure your admins are a small team, well trained, well educated on the risks of getting it wrong (and understanding it IS their fault if it fails), and they collaborate tightly.