Understanding Cloud Security: Your Partnership with Atlassian

In today's fast-paced digital world, many teams are moving to the cloud to boost collaboration, scalability, and overall efficiency. Atlassian products like Jira and Confluence have become key players in this shift, enabling seamless teamwork from virtually anywhere. However, as more companies embrace the cloud, a common concern arises: how secure is our data? This is where understanding cloud security and the concept of shared responsibility becomes essential.

In the cloud, security is a shared responsibility. It's a collaborative effort between Atlassian and its customers to keep data safe, accessible, and compliant. Let's dive into how this partnership works, what Atlassian takes care of, and what responsibilities fall on customers to keep their cloud environment fully protected.

Atlassian's Responsibilities: Building a Secure Foundation

Atlassian takes on the foundational aspects of cloud security, from infrastructure upkeep to compliance, so customers can use their products with confidence:

• Platform security and reliability: A resilient infrastructure with disaster recovery, high availability, and a 99.9% uptime SLA, with failover in place so Jira and Confluence stay accessible even during service disruptions.
• Infrastructure maintenance: Atlassian keeps servers, networks and data centers patched and up to date, so customers can focus on their own data rather than the underlying system.
• Compliance certifications: Certifications such as ISO 27001, SOC 2 and GDPR mean Atlassian's systems are built and monitored to meet global standards for data handling and security.
• System-level backups: Platform-level backups support disaster recovery, though customers should still consider their own backups for the data that matters most to them.
• Baseline security for Marketplace apps: Atlassian verifies Marketplace developers and scans apps for vulnerabilities, giving customers a baseline of trust before extending Jira or Confluence with third-party apps.

Customer Responsibilities: Securing Your Environment

While Atlassian handles platform security, customers play an active role in managing their own data and access controls:

• User access and permissions: Set up roles, review permissions regularly, and revoke access promptly when someone leaves. Access hygiene is on the customer, not the platform.
• Data content and management: Atlassian provides a secure platform, but customers control what gets stored in it, including how sensitive data is organized and governed.
• Domain verification: Verifying your domain lets you centrally manage all associated Atlassian accounts and enforce policies like SSO and MFA.
• Marketplace app selection: Review the permissions an app requests before installing it, and only integrate apps that meet your organization's security standards.
• Password policies and authentication: Enforce SSO, MFA, and periodic password changes with Atlassian Access to minimize the risk of unauthorized access.

A Real-World Example of Shared Responsibility

Imagine a company using Jira for project management. Atlassian's platform ensures uptime, data protection, and compliance, but the IT team still has to monitor access permissions, verify their domain, centralize access, and enable MFA. They also vet every Marketplace app before it's allowed near their environment. Both sides of the responsibility model have to hold up their end for the environment to stay secure.

Practical Tips for Customers

• Regular access reviews: Schedule quarterly reviews of user access, removing anything no longer needed.
• Use Atlassian Access for SSO and MFA: Centralized authentication management makes it easier to enforce policy across the organization.
• Audit Marketplace apps regularly: If an app's permissions no longer match your security policy, it's time to reconsider it.
• Create a data management policy: Decide up front what data belongs in cloud-based products, and what doesn't.

Conclusion: A Strong Partnership for Secure Cloud Usage

Cloud security is a collaborative effort. Atlassian provides a secure, resilient platform, but customers need to actively manage their own data and access controls. Understand and fulfil your side of that responsibility, and the partnership does what it's meant to: keeping your data protected and your organization compliant.