Can you restrict who can send an email to update the status?

First Title May 3, 2022

We're in the process if implementing this solution and when security reviewed the process their comment was that security through obscurity isn't appropriate.

The email address used to update the status is very long, random and unique enough not to be guessed. However, if this email address gets compromised then anyone from any random source address can update the status.

Is there a way to restrict the update to a predefined list of source domains and/or email addresses?

1 answer

1 accepted

0 votes
Answer accepted
Darryl Lee
Atlassian Team
Atlassian Team members are employees working across the company in a wide variety of roles.
May 5, 2022

Hi @First Title

This is Darryl. I am here to help. 

Thanks for the feedback on the security concerns about the Email automation for Statuspage components.

Unfortunately, there is no way to restrict the "from" sources for the Emil automation and we do have an existing feature request to "Create Allowlist for Email Addresses used in Component Automation".

The ticket ID is, STATUS-348, and we will keep you posted because the ticket doesn't provide any public access to our customers.

Thank you very much again for your feedback in helping us improve Statuspage.

Have a great day and stay safe.

Kind regards,
Darryl Lee
Support Engineer, Atlassian

Darryl Lee
Atlassian Team
Atlassian Team members are employees working across the company in a wide variety of roles.
May 5, 2022

@First Title, On the other hand, we also recommend switching to using the third-party services (Pingdom/New Relic) or the "unsupported" third-party services as alternatives for Statuspage component status automation. -> https://support.atlassian.com/statuspage/docs/get-started-with-email-automation/#Using-third-party-services

Or, if you also have an Opsgenie subscription, it would be awesome to incorporate the Statuspage integration for accomplishing this objective.

Hope this helps.

Kind regards,
Darryl Lee
Support Engineer, Atlassian

First Title May 5, 2022

Thanks for your reply, happy to be on your distribution list to be notified when STATUS-348 get released into production. 

The third-party & alternate services to update the component still rely on an obscure email address which doesn't mitigate the security concern raised initially.

I note there is no option to turn off the email address or this automation service. Even if we chose to only update the components manually, the risk remains the same.

Like Darryl Lee likes this
Darryl Lee
Atlassian Team
Atlassian Team members are employees working across the company in a wide variety of roles.
May 6, 2022

Thanks for the extra feedback and I have added them to the feature request ticket for our development team as a reference.

Suggest an answer

Log in or Sign up to answer
TAGS
AUG Leaders

Atlassian Community Events