Security in Jira (DevSecOps capabilities in Jira Software)

[#1]

Open DevOps - Security in Jira 

Secure your code from development to release

Shift-left security testing and catch vulnerabilities before they hit production.

In partnership with security testing experts, Jira Software Cloud enables security and development teams to collaborate in a single unified pane, by bringing vulnerabilities into the context of developer sprints. Apply to our early access program for a sneak peek into our latest DevSecOps capabilities.

Apply Now

All within Jira Software's Security tab, you can...

Audit Get a comprehensive view of all vulnerabilities impacting your project.

Assess Collaboratively triage vulnerabilities based on impact to code component and base.

Assign Quickly file tickets with pre-populated fields and assign tickets to code authors.

Automate Jira automatically links vulnerabilities to issues, providing the context needed for quick fixes.

Find your ultimate DevSecOps workflow

Test-in-depth security in crucial for any product security program. Open DevOps' aspires to support your ultimate DevSecOps workflow, no matter the tools you use. Explore the integrations Security in Jira supports today.

Snyk Try for free	Mend (formerly WhiteSource) Try for free
Stackhawk  Try for free	Lacework Try for free

Join the Open DevOps partnership program In security testing, there will never be one tool, one vendor, or one security technique to rule them all. A safe, secure digital world is built together. Learn how your security testing solution can join our partnership program. See our API support docs for technical information. Contact us at platformpartners@atlassian.com for information on our program.

Integrate your DevOps tools today From Discover to Build to Deliver to Operate, Open DevOps supports your ultimate DevSecOps workflow, no matter the tools you use. See the full catalog of tools we support. See catalog

[Bryan Guffey]

Is this Cloud-only? It would be helpful if the phrase “Jira Software Cloud” was used when talking about features only available in Cloud :)

[Tamulyn Takakura]

Hi @Bryan Guffey . Great call out! Thanks so much for you suggestion on how we can improve our content. I've made adjustments to the article.

Yes, Security in Jira and all other Open DevOps capabilities are cloud-only. For more information on Open DevOps, check out this link: https://www.atlassian.com/solutions/devops 

Let me know if you have any other questions. I'm happy to help!

[Maximilian Hamm]

Dear @Tamulyn Takakura 

Is it necessary to use Snyk to be able to use the presented functions?

[Tamulyn Takakura]

Hi @Maximilian Hamm

Nice to e-meet you! Great question. Currently, the early access program is only for Snyk integrations. We are actively working on expanding support to a portfolio of security testing vendors beyond Snyk, so please keep an eye out! May I ask what security testing tools you're most interested in? We're currently collecting feedback on what our customer want to see.

Outside of our early access program for this feature, we support a variety of security testing vendors for Jira Software. You can see the full list here: https://marketplace.atlassian.com/search?marketingLabel=devops-security 

[Noushin Kananian]

Good info. Thanks for sharing your invaluable knowledge and experience. 

[Danny]

Cannot wait to get my hands on this and try it out myself. Thanks @Tamulyn Takakura for the update 

[Jamie Rogers]

Great info, thanks.

[Fabio Racobaldo _Herzum_]

Very interesting info. Thanks for sharing @Tamulyn Takakura 

[Oliver Siebenmarck _Polymetis Apps_]

Very cool! I'm so looking forward to trying out the Snyk integration. It's still EAP-only, right?

[G subramanyam]

Thank you for sharing the detail and API support document link.

[Daani Faiz]

Hi @Oliver Siebenmarck _Polymetis Apps_ Great question! 

We are still running the EAP, however we will be rolling out the feature to customers in a public beta over the coming weeks. If you've submitted an early access request, stay tuned and we will look to get you enabled in the next few days.

Let me know if you have any other questions. I'm happy to help!

[ibrahim_aly]

Thank you for sharing a great article

[Sara Tucker]

Hi! I was added to the EAP a several days ago but I still can't seem to find the option to toggle this on within a Software project. Anyone know of any troubleshooting steps I can try to get that to show up? 

[Daani Faiz]

Hi @Sara Tucker

Thanks for reaching out.

Sorry to hear you haven't been able to get set up. To enable the feature:

1. Go to Project Settings and click Features (in the left side bar of your project)
2. Toggle the Security feature on.
3. Return to your project, and you will find the Security tab in the left sidebar.

If the steps provided above do not work, please reply to the "Feature On" email from our team with your Atlassian site ID (xxx.atlassian.net). From there we can make sure we've enabled the right ID.

Looking forward to getting you started with Security in Jira in our EAP! 

[Justyna Gdowik _ Deviniti _]

That's some really valuable information! 🙌

[Hana Kučerová]

Thank you. I'm looking forward to trying it myself.

[Akshat Sharma]

Are there plans to enable Prisma for this integration?

[Anthony Morais]

Very good! Thanks for sharing

[Daani Faiz]

Hi @Akshat Sharma

Thanks for your question. Security in Jira is currently live with Snyk, Mend, Lacework, Stackhawk and JFrog. As a part of this experience we are absolutely working to add in additional vendors. While we cannot confirm plans at this stage to integrate with Prisma, this is a great suggestion which our team will look into.

Please reach out if you have any other vendor suggestions!

[praseeb kdas]

@Tamulyn Takakura  Very interesting Article. Thanks for sharing!

[Jue Wang]

Is there any separate cost for this security integration? 

I assume we need a separate license with those third-party vendors like Snyk correct?

[Rama krishna]

Nice Post

[Nicholas Savage]

Prisma Cloud integration please.

Aside from the task/vulnerability management aspect of having this data in Jira, the other benefit would be exclusion management (typically for Lab environments or known/accepted vulnerabilities) as currently in Prisma Cloud one is not able to add meta data such as when the exclusion was added, why, for who etc. A use case to consider.

[Mike P]

Any plans to bring this to Data Center?

[Magdalena Wisniewska]

Is the Early Access still available?

I am getting "Not Found" message when clicking on Apply Now.