How can I keep Jira secure whilst opening Service desk to the Internet?

Question

Currently Jira sits on the corporate LAN behind the firewall. Internal users access it via the corporate LAN, but can also access it outside the office using VPN. Moreover, the base url "http://jira-xx:8080" only works when you are logged on to the corporate LAN.

Now we are adding Service Desk for external customers. We have had to change the Jira base url to one which anyone on the internet can use (https://...) because it has to be the same as the Service Desk url (surely this is a defect in the design of Service Desk?). As a result, anyone on the internet can get to our Jira's login page. They still need to have a valid login and password to get in the normal route, but the mere fact that they can get to the login page is a security risk since Service Desk and Jira are so closely connected.

Has anyone had this problem and is aware of a resolution?

For example, can we separate Service Desk (with or without it's own Jira project) from Jira, place it in a DMZ and connect it with Jira via the firewall thereby keeping Jira inside the corporate LAN?

Adam

Adam Sterrie · Answer

Thanks Igor.

At the moment Atlassian have no inclination to resolve this security risk, even though it may push potential customers for Service Desk to other vendors (e.g. there is a connector between Salesforce and Jira that synchronises the two at the push of a button).

I wonder if the issue collector functionality in Jira can be pointed at a Service Desk!

Igor Sereda [ALM Works] · Answer

Hi Adam,

I think what you propose is a reasonable solution. We do this ourselves, we have a public-facing Jira Service Desk and an internal Jira for the development team.

The challenge is to keep them connected - we currently rely on the support team creating remote issue links between support and development tickets and development team updating the support tickets when a related issue fix has been delivered (so the support team can contact the original ticket reporter).

Nothing ground-breaking, sorry :)

Igor