Security Best Practices

[Brad Rehm]

We've had our Production Jira installation in place for several years. Previously, it was managed only by the various development groups. Over time, it's grown and we're now seeing security issues with users having more permissions than they need. Now that the system is under IT management, we'd like to address this concern and are looking for best practice documentation on how to properly set up groups/permission schemes/etc...

Do you have such documentation available? If so, can you provide links? Thanks much

[Bruno Rosa · Accepted solution]

Hi There,

Here are some documentations regarding permissions at project and issues level:

JIRA allows you to control who can access your project, and exactly what they can do (e.g. "Work on Issues", "Comment on Issues", "Assign Issues"), by using project permissions. You can also control access to individual issues by using security levels. You can choose to grant access to specific users, or groups, or roles (note that roles are often the easiest to manage).

Permission Scheme — the project's permission scheme determines who has permission to view or change issues in this project.

Issue Security Scheme — the project's issue security scheme determines what visibility levels issues in this project can have (see issue-level security).

Here are some general documentations about groups and roles:

• Managing Groups
• Managing Project Roles

Hope this helps!

Cheers,

Bruno Rosa