Secure connection

Cristina Rodríguez Amado

Hello, 

I´m installing an integrated solution with jira service desk and confluence for an enterprise.

We work with a few diferent companys and need to give support for all of them.

We plan to have one project of jira for every company with an asociated confluence space.

 

We are dealing with a few security obstacles.

-We would like not publishing our confluece space on internet but want our clients to have access to their space via jira. We want to have our private resources on a diferent space of confluence and we consider it's insecure to publish it.

It´s some way to do this?

There is some kid of two factor authentication?

We need to ensure our private information.

 

Our servers are behind a SSL reverse proxy.

 

Which is the best aproach to this kind of instalation? 

 

Thank you in advance.

Regards.

 

Dave Theodore [Coyote Creek Consulting]

You really should start with a conversation with your Infosec team to see what they will require.  Fundamentally, you will be giving your Jira and Confluence instances direct internet access. The Application security can ensure that users can see only the content they are supposed to, but not all Infosec teams are comfortable with relying on application security. Then there is the concern about application vulnerabilities and the ability for hackers on the internet to have the ability to exploit them.

This is an issue that many companies are facing.  Here is what we commonly see with clients the we work with. I'd expect one of these will apply to your company as well.

1. Infosec is totally OK with the security provided by SSL and application security to limit access to logged in users. Simply expose your Confluence and Jira to the internet, configure SSL and appropriate application security and you're good to go.
2. Infosec has some policy requirements for a system to be made internet accessible. These vary, but 2 factor auth, client certificates, IP address whitelisting or some additional steps are required.  You will need to jump through these hoops in order to satisfy Infosec, if this is the case.
3. Infosec is OK with only the content that is exposed to external users being on the internet, but not all content. In this case you have an internal and external Jira and Confluence (ie: 2 instances of each application) and you synchronize data between them as appropriate. If you can avoid this option, you should. It's costly, messy, complicated and will never feel very polished, as none of the Atlassian tools were designed with this use case in mind.  There are a number of 3rd party Apps that can perform these functions, though.
4. Infosec says no way those services can be on the internet. In this case, you give your external users VPN access or go rogue and set up an Atlassian Cloud instance that you interface with your external users on.

We typically work with Infosec at our clients to give them all the information possible. This can help them make an informed decision.  Often times, the initial response is based on ignorance of the tools capability, and once they understand how application security works and what the risks are, you might be able to do #2 above.