Denial of Service for JSM Forms

[george_bullock]

How to you (or I) reduce the likelihood of a Denial of Service attack to a JSM Form

Our form as 1st time sign in but I am sure that could be breached

[John Funk]

Hi George,

See if this documentation helps:

https://confluence.atlassian.com/security/preventing-security-attacks-in-jira-service-management-1409093088.html

[george_bullock]

Thanks John - but that seems to point to what we do.

As we are on JSM Cloud I assume JSM has some sort of Denial of Service approach - we are getting our external Users to create a password but like all these things we cannot mandate to them the password other than what JSM already does.

[John Funk]

Correct - user accounts (and therefore passwords) belong to Atlassian, not your instance. So the same user account (i.e. email address) can be used in multiple instances across the world - not just ones owned by a single organization. 

[Marc - Devoteam]

Hi @george_bullock 

See, https://www.atlassian.com/trust/security/detections-program and https://www.atlassian.com/trust/compliance/resources/acsc-cloud-computing-security/guidance 

[george_bullock]

Thanks Marc

I am guessing this is the answer

Atlassian Security Engineering uses IPS technologies that are implemented in our office environments. Network threat protection is performed by AWS, including DDoS protection and some Web Application Firewall features.

Regarding Specific ProductsJira Align uses Cloudflare for WAF, DDOS, DNS-SEC. We use Alert Logic IDS, log analysis, and cloudtrail. We use Nexpose for scanning shared network components with Atlassian Cloud stack. We use custom Splunk log analysis.