Create
cancel
Showing results for 
Search instead for 
Did you mean: 
Sign up Log in

Atlas CRM Permission Model Updates - Risk of a Security Breach

Matthew Jones
I'm New Here
I'm New Here
Those new to the Atlassian Community have posted less than three times. Give them a warm welcome!
January 25, 2022

The recent Atlas CRM cloud update included the removal of Jira groups to control access which in turn replaced any access previously configured with allowing access to all Jira users.

This is extremely poor for a number of reasons:

  • It provides previously unauthorised users with access to data, some of which is classified as 'Personally Identifiable Information' (PII) which is within the scope of the GDPR. Therefore, this change could result in legal and regulatory privacy issues for users of this application.
  • Going forward, permissions are applied to users rather than groups. Even though you can 'bulk' add users based on selecting a group which in turn returns group members to add, for any future updates, you'll need to repeat the process rather than just specify the group once and then handle membership accordingly (e.g. through an automated well defined Joiner-Mover-Leaver (JML) process).  This increases admin overhead and the risk of access configuration issues / unauthorised access (e.g. a Jira user moves teams, for which there is a group and they're a member of, following which they are removed from the group (let's say 'CRM Users'), however that user will remain in Atlas CRM unless a CRM admin removes the individual account from the permissions list.

I've raised a ticket with the vendor about this but thought I would call it out for anyone else that may have experienced the same or isn't yet aware.

1 comment

Comment

Log in or Sign up to comment
Mitchel Kuijpers
I'm New Here
I'm New Here
Those new to the Atlassian Community have posted less than three times. Give them a warm welcome!
January 25, 2022

Hi Matthew,

Please know that we take these reports very seriously. We have answered to you in the support ticket, but we would like to give some clarity here.

Permissions scheme change

We have communicated the following on Tuesday December 21st 2021, to all customers that are known by us from the Atlassian Marketplace, that we would update our permissions scheme on January 22nd.

From now on, you can no longer define user-groups that have access to Atlas CRM. You will need to define a list of users instead. Just like before, an empty permissions scheme will result in full access for every Jira user that can either access Jira Core, Jira Software or Jira Service Management.

Jira administrators can always access Atlas CRM.

The migration on January 22nd 2022

For each installation that is known to us, we have updated the permission scheme by fetching all members of the configured user-groups and add them to the list of users that have access. See the example below:

If you had configured that the user-group “CRM users” can access Atlas CRM, and that group contains two users, we have added both users to the list of users that have access.

Before

Access to: Users in group ‘CRM users’

After

Access to: User A, User B

Our research

After you contacted us, we immediately took the following security check and found no breach for your instance. We also did this check for all of our other customers.

Closing thoughts

Please know that we take security very seriously at Avisi Apps that is why we are Cloud Fortified and we maintain all GDPR standards, we have a SOC 2 declaration and posses a ISO 27001:2017 certification.

We hope that you like the new features that have been added in this update.

Kind regards,
The Atlas CRM Team

Like # people like this
TAGS
AUG Leaders

Atlassian Community Events