Confluence and security

Sélim Ikkache

Hi all, I have several question, and these questions concern both Confluence Server and SaaS solution.

We need to choose a wiki solution and, functionnaly, we would like to choose Confluence. But our CISO ask a lot of questions that we need to answer :

 

1.1. HOW CONFLUENCE DEALS WITH ACCESS CONTROL ?
Only via a user / pwd connection?
Is there a way to connect to our internal directory?
Is there possibility to control by IP source?

1.2. DATA DIVISION
How is the data partitioned?
Is there a tenant management?
We would like to have a secure access for our whole organization (Digital Branch of the Post Office).

1.3. RIGHTS MANAGEMENT
How are managed data access permissions?
We need three kind of accesses :
• Public pages: accessible to anyone having the URL
This concerns user manuals that  can be accessed by the general public.
• Internal Pages La Poste: information that we want to share in our organisation, but not with the whole world, for example, business information: road map, product quality
• Internal project pages: data such as technical specifications, internal procedures, ... only accessible for the project team

1.4. ACCESS TO DATA BY THE HOST (Atlassian or the host in case of on premisce)How can we ensure that the data is not accessible by the host?

1.5 SERVICE AVAILABILITY
What are the SLAs for service availability?
How (for the server solution) can we guarantee high availability (server cluster, etc ...)

1.6. INTEGRITY OF STORED DATA
Does Atlassian guarantee that it does not modify data, either during transport or when the transformation operations are performed on the servers (either on-site or on the SaaS solution)

1.7. ACTIONS LOGGING
Are actions on Confluence logged? If yes, can we access these traces and how ?
Similarly, are system operation logged? If yes, is there an access?

 

Thank you for your answers

Nic Brough -Adaptavist-

This is a bit short, but a lot of it is an essay question, probably better answered by a search on Atlassian docs.  

Some of these brief answers are dead-ends, there's nothing more to say, but we can expand on most or all of these if you need.

 

For server:

1.1. HOW CONFLUENCE DEALS WITH ACCESS CONTROL ?

User/password, but you can hook it up to directories, use SSO and customise this with code.

IP by source is up to your network, Confluence won't do it.

1.2. DATA DIVISION

It is not.  The application allows a lot of partitioning by space, but the rest is not.

1.3. RIGHTS MANAGEMENT
You do all of that by space permissions.

1.4. ACCESS TO DATA BY THE HOST

Your data access processes are yours

1.5 SERVICE AVAILABILITY
Up to your service team

1.6. INTEGRITY OF STORED DATA
Up to your data storage team

1.7. ACTIONS LOGGING
There are log files, with a default level of logging, which can be increased if you need more

 

For Cloud

1.1. HOW CONFLUENCE DEALS WITH ACCESS CONTROL ?

Atlassian accounts, Google accounts, or Atlassian Access (which can be used to hook up to standard LDAP directories you own)

No IP access control

1.2. DATA DIVISION

It is not.  The application allows a lot of partitioning by space, but the rest is not.

1.3. RIGHTS MANAGEMENT
You do all of that by space permissions.

1.4. ACCESS TO DATA BY THE HOST

You can't - in order to provide SAAS, Atlassian need access to it

1.5 SERVICE AVAILABILITY
See https://confluence.atlassian.com/support/updated-support-response-slas-951415350.html and check the Cloud column.

1.6. INTEGRITY OF STORED DATA
They will only modify data as part of support or if you ask them to.

1.7. ACTIONS LOGGING
Minimal, through the UI (no access to logs)