JIRA: Security of processing
Introduction
The GDPR requires that personal data be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage. What measures you use to secure the personal data depend on the type of personal data processed, the risk to the individual and relevant industry standard practices. Security measures implemented will vary on a case-by-case basis, and you should be chosen with the assistance of legal counsel. Below is a summary of security tools and configurations available to you within certain Atlassian products, along with how to implement.
Please note that Atlassian recommends that customers implement a secure and reliable network that ensures the protection of its users' data in the infrastructure that is hosting our applications.
Securing Your Infrastructure
Atlassian strongly recommends that customers implement SSL to secure the TCP communication between JIRA and its users or any other system interacting with it. This includes the database and LDAP (for external user directory). Depending on your organization's needs, the following documentation may be helpful:
- Running Jira applications over SSL or HTTPS
- How to configure JIRA server applications for Security Best Practices
- Configuring security in the external environment
- Preventing security attacks
Running JIRA Server in the Cloud
If you are hosting your JIRA instance on any cloud service (AWS or Microsoft Azure), work with your cloud service provider in order to come up with a suitable plan for securing your environment.
Jira Data Center
Node communication
By default, communication between nodes in your cluster is done through unencrypted ehcache RMI. Not restricting access to the ehcache RMI port (by default this is 40001) could result in the compromise of your JIRA Data Center instance.
Loadbalancer
In JIRA Data Center, you are required to have a load balancer in place for the load to be spread across the cluster nodes. For increased security, we recommend that you secure the communication between the load balancer and the JIRA nodes.
Jira Server and Data Center
Security best practices
Atlassian offers some best practices for securing both your network as well as your JIRA application. Please review the documentation:
Upgrades and Updates
You should keep JIRA up to date is to stay protected from security threats. We recommend upgrading JIRA to the latest available version regularly, however if your organization's process means you upgrade on a regular cadence, we suggest upgrading to an Enterprise Release. An Enterprise release provides continued access to critical security, stability, data integrity and performance issues until this version reaches end of life.
The current JIRA enterprise releases are:
There are several ways to upgrade JIRA, and the method you choose to use depends on which version of JIRA you use, and the type of environment you use it in.
For more in depth information about our enterprise releases please check through the following announcement:
Health checks
A health checks will check your application for known issues. Our Premier Support team can help you run health checks on a quarterly basis on your installed products in production, QA, and staging environments to help prevent outages and ensure best practices are followed. During a health check, our team will look for known issues with configurations, compatibility, driver versions, performance conditions, memory settings, and other improvements. Health checks can be very helpful as a preventive tool for production outages and slowdowns as well as during system upgrades to ensure success. This information is collected to generate a system health baseline report and prescriptive roadmap that recommends how you can improve performance, scalability and productivity of your JIRA instance.
More information:
- Instance Health
- Jira Data Center Health Check Tools
- Cluster Index Replication health check fails in Jira Data Center
- Cluster Locks health check fails in Jira Server
- HealthCheck: Scheduler
- Cluster Cache Replication health check fails in Jira Data Center
- HealthCheck: Cluster Time Synchronization
- HealthCheck: Shared Home
- How to retrieve Health Check results using REST API
Monitoring
Atlassian provides a best practice guide for system administrators who would like a clearer view of what's happening in their instances, and get the most out of Atlassian Support. The guide describes what we consider the best tools for monitoring and analyzing diagnostic data produced by Atlassian products, and show you the best way of getting this information to the Atlassian Support team when required. More details are available here: Best practices for performance troubleshooting tools.
For large instances of JIRA Server or JIRA Data Center, enabling JMX allows you to more easily monitor the consumption of application resources. This enables you to make better decisions about how to maintain and optimize machine resources. More details are available here: Live monitoring using the JMX interface.
Operating System
JIRA is a pure Java-based application and should run on any supported operating system, provided that the JDK / JRE requirements are satisfied.
Virtual Machine (VM) environments have become a common way for system administrators to manage and deploy their IT systems. Many customers are successfully running their instances on VMware already. However, setting up an Enterprise Java application in a virtual environment requires proper configuration and tuning to maintain high performance. This document summarizes the most important practices on configuring and tuning VMware to work with a Java application like Jira: Run Jira server in a virtualized environment.
Network
The following guide describes the specific network and connectivity errors that can be diagnosed automatically by application links and the actions you can take to correct those errors. It also provides a general troubleshooting guide to help you identify and correct network and connectivity errors that may occur when using JIRA application links: Network and Connectivity Troubleshooting Guide.
Database
JIRA uses a database connection pool, based on Apache Commons DBCP (DataBase Connection Pool), to manage JIRA's access to its underlying database. The information on this page can help you tweak JIRA's database connection pool settings. You can do this by using the JIRA configuration tool. The Advanced tab of the JIRA Configuration tool makes it easier to both configure and control JIRA's database connection pool. The Database monitoring page (accessible to JIRA system administrators) provides a visual tool for monitoring JIRA's database connection usage. You can also review this article on Tuning database connections for more information on maintaining a high performing database connection.
Change management
Effective service desks plan and control changes, and they understand their impact on their business. An Information Technology Infrastructure Library (ITIL) change management workflow aims to make your change efforts successful. The JIRA Service Desk IT Service Desk template comes with a change management workflow. This workflow ensures you record, assess, approve, and implement change requests. We recommend you start with our default workflow and adapt it to your business needs.
If done well, a change management process:
- stabilizes your IT services
- makes IT services reliable and predictable
- adapts IT services to evolving business needs
- lessens risk, outages and defects
For more information on change management, please review Managing changes with your IT service project.
Authentication and Authorization
Implementing security is an essential part of integrating with JIRA. It lets Atlassian applications protect customer data from unauthorized access and from malicious or accidental changes. It also allows administrators to install add-ons with confidence, letting users enjoy the benefits of add-ons in a secure manner.
There are two parts to securing your JIRA add-on or integration: authentication and authorization. Authentication tells JIRA the identity of your add-on or integration, authorization determines what actions it can take within JIRA. More information: Security overview.
Authentication is the process of identifying your add-on or integration to JIRA and is the basis for all other security. The JIRA platform, JIRA Software, and JIRA Service Desk REST APIs can use one of the following two methods to authenticate clients directly.
- JIRA Developer Documentation : JIRA REST API Example - Cookie-based Authentication
- Allowing OAuth access
User management
As an administrator, you can manage users directly in JIRA or enable public signup so users can create their own accounts. You can refer to these pages for information on managing users across multiple projects and applications.
Application access
To grant users log in access to a JIRA application, the application must first be licensed, and secondly, the application must have at least one default group assigned to it. Any users added to this group will be able to log in to the application. This is called application access. Your JIRA application may have more than one group assigned to it, and a user may be a member of more than one group assigned to the application, but they will only count as one licensed user for that application.
- Licensing and application access
- (Archived) How to limit or restrict a user's project access in Jira server
- Manage group access to applications
Permissions
Permissions are settings within JIRA applications that control what users within those applications can see and do. All JIRA applications allow a variety of permissions: from whether users can create new projects to whether a user can see a specific type of comment on an issue. These permissions can differ between applications.
- Permissions overview
- Managing project permissions
- Assign users to groups, project roles, and applications
- How to restrict project access to different isolated user groups
Backup and Restore
JIRA supports generating backups, automated backups Configuring automatic database backups and restoring them.
Advanced Configuration
JIRA has a number of configuration options that allow your JIRA applications to be customized for use within your organization. These options can be accessed and edited on JIRA's 'General Configuration' page.
Atlassian Security & Bug Bounty Program
Atlassian releases regular security advisory reports to inform our customers about security vulnerabilities. These can be viewed and tracked in the Security Advisories.
Atlassian offers the community a way to contribute in enhancing the security of our products through the Vulnerability Bug Bounty Program.
Additional notes
There may be limitations based on your product version.
Note, the above-related GDPR workaround has been optimized for the latest version of this product. If you are running on a legacy version of the product, the efficacy of the workaround may be limited. Please consider upgrading to the latest product version to optimize the workarounds available under this article.
Third-party add-ons may store personal data in their own database tables or on the filesystem.
The above article in support of your GDPR compliance efforts applies only to personal data stored within the Atlassian server and data center products. To the extent you have installed third-party add-ons within your server or data center environment, you will need to contact that third-party add-on provider to understand what personal data from your server or data center environment they may access, transfer or otherwise process and how they will support your GDPR compliance efforts.
If you are a server or data center customer, Atlassian does not access, store, or otherwise process the personal data you choose to store within the products. For information about personal data Atlassian processes, see our Privacy Policy.