Adrian Ludwig Atlassian Team

Thanks @Alex Hope This is a great read and provides a wonderful view on how you approached the challenge. I'm really excited to see Icarus Labs begin to reveal some of it's work, and can barely wait to read more in the future!

Hi @Adam Sterrie You're right, I missed a question. I apologize for the oversight. We believe that this attempt at ransomware is a case of credential stuffing. Basically, that means these accounts were compromised when the account credentials were published or leaked in another location, and then an unathorized person used…

Hi Ian, This is an area that we have received a number of questions about, being a prominent Australian tech company. That said, there is a lot of confusion about this law and the impact that it could have with respect to customer data. The law was written in such a broad fashion that it effects all of the major cloud…

Thanks @Boris Berenberg - Atlas Authority -- I meant to say JIRA Align (the new Atlassian product following the Agilecraft acquisition).

Hi @Shane Phelan , Great question, and one that I think a lot about! At Atlassian we have a central security team that builds our security processes and infrastructure that is shared broadly across the company. And we also have an expectation that everyone at Atlassian has a shared responsibility to make sure that we build…

Hi Shyam, I'm not sure I understand the question -- so I'm going to reach out to some colleagues on JIRA service desk to see if they can help. Adrian

Hi @Mario Areias I’ll try to give a brief overview, but you can find more information on our Security Practices page on the Atlassian Trust Center. Our threat model, at it’s highest level, considers every party that has access to our environment to be a potential threat. This includes all parties on the internet, all of…

Hi @Michael March , We are constantly looking to improve how well app vendors are prepared to manage customer data. In December, we published a page for Security Guidelines for App Vendors. The main emphasis were proactive recommendations that each of the App Vendors can take to improve security practices, including…

Hi @[deleted] , We have an active bug bounty which provides continuous third party testing of Atlassian products. You can read more about the details about our approach to security testing of our products and our environments at : https://www.atlassian.com/trust/security/security-testing At the bottom of that page, you can…

Hi @Barb O_Connell, I can give you a quick overview and update. All data sent between our customers and our applications is encrypted-in-transit using Transport Layer Security (TLS) 1.2+ with Perfect Forward Secrecy (PFS) to protect it from unauthorized disclosure or modification. Our implementation of TLS enforces the use…

Hi @Jon Doyscher, That’s a short questions – and it deserves a much longer answer than I’ll have a chance to provide here. But I'll give it my best shot. For me, the two most important things have been to always be working on something that I find challenging and that forces me to learn something new every day. Ideally,…

Hi @Kimberly Deal _Columbus ACE_ , Certifications is one of the most frequent questions that we get, so we have already invested in many certifications and controls to ensure that we are keeping keeping sensitive data private and secure in our cloud products. We’ve achieved SOC2 and SOC3 compliance as well as ISO27001 and…

Hi Prasenjeet, There are new security issues found every day, so we don't generally release advisories to say that an issue doesn't affect one of our products. Our security team has investigated CVE-2018-11776 and we can confirm that no Atlassian products are affected by this vulnerability -- this includes Bamboo. While we…