Security Concerns: Adding Sensitive Informations in Jira Tickets/Comments

[Parth Shah]

I using Jira (mainly for ticketing) am facing problem while putting sensitive information on tickets tagged with security team, when I am asked to share sensitive information like authentication-policies/ confidential security policies with mates for review and approvals.

I am looking for an options like :-

• Attachment Restrictions – Attachments can have settings option to restrict access per file or provide expiring links.
• Comment Restrictions - Have settings to restrict comment visibility to intended person/s only, rather to whole Project or Board members.

• Built-In Encryption per Item – Comments, text, and attachments can be individually encrypted; instead of they rely only on role/permission-based access.

• One-time Access comments/attachments- which allows me to put short text/file, which remains encrypted, and is intended to be read only once, post that it get's inaccessible. 

This will help me to-

• Reduce Risk of Data Leakage – Integrations, notifications, and backups can inadvertently expose sensitive information if SI (sensitive info) are stored directly in Jira.

Looking forwards to reply to address concern. Thank you.

[Matteo Vecchiato]

Hi @Parth Shah ,

Welcome to Atlassian community.

My two cents on this topic:

Natively, you can't restrict: attachments per file, comments visibility ( available only in JSM)

There isn't any built-in encryption at work item level, comments and so on.

You can set security only at work item level, through Security levels.

In my opinion, you shouldn't save sensitive data on Jira like passwords and secrets, you should store them in a dedicated software and in Jira adding only a link/reference to them.

I hope it helps 

[Varsha Joshi]

Agree with all the items @Matteo Vecchiato highlighted. One suggestion that I could offer is store your doc on sharepoint give point access. Ofcourse with a link in Jira so there is a trail of the communication.