{"id":4169,"date":"2023-06-01T10:41:45","date_gmt":"2023-06-01T10:41:45","guid":{"rendered":"https:\/\/gitprotect.io\/blog\/?p=4169"},"modified":"2024-12-11T09:48:17","modified_gmt":"2024-12-11T09:48:17","slug":"navigating-atlassians-data-protection-challenges-in-the-cloud","status":"publish","type":"post","link":"https:\/\/gitprotect.io\/blog\/navigating-atlassians-data-protection-challenges-in-the-cloud\/","title":{"rendered":"Navigating Atlassian’s Data Protection Challenges In The Cloud"},"content":{"rendered":"\n

With the rise of remote work, Atlassian Product Suite has become much more prevalent among companies for managing their teams and data. Though, not every company dives deep into understanding what cloud security measures Atlassian have and what obligations are rested on the organization\u2019s shoulders.<\/p>\n\n\n\n\n\n\n\n

In this blog post, we are to go through Atlassian\u2019s Data Protection Challenges in the Cloud, but first, let\u2019s figure out what Atlassian’s Cloud Shared Responsibility Model is before we jump into Atlassian Data Protection Gaps. <\/p>\n\n\n\n

Atlassian Cloud Shared Responsibility Model: the main points<\/h2>\n\n\n\n

What helps you understand your duty and obligation, and what responsibilities are on your cloud service providers? The Shared Responsibility model is an answer to this question. <\/p>\n\n\n\n

On the main page of Atlassian Cloud Security Shared Responsibility, the cloud service provider emphasizes that together with customers they \u201care on the same team and are here to support your<\/em> (customers\u2019) needs across our platform.<\/em>\u201d Yet, let\u2019s take a closer look at each party\u2019s obligations.<\/p>\n\n\n

\n
\"Atlassian<\/figure><\/div>\n\n\n

Source: Atlassian Cloud Security Shared Responsibilities<\/a><\/p>\n\n\n\n

Atlassian Cloud Shared Responsibility model is grounded on four main principles: reliability, security, privacy, and compliance. Though, as you can see from the graphic, Atlassian\u2019s duty is to take care of its system and application running well while a customer is responsible for taking care of its own data, and third-party applications they use. So, if Atlassian experiences an outage or faces any other security risks, Atlassian deals with it, if you experience a ransomware attack, outage, or any other event of failure leading to data loss, it is your responsibility to take care of the problem. <\/p>\n\n\n

\n
\"Atlassian<\/figure><\/div>\n\n\n

Suppose you want to boost your knowledge about Atlassian Shared Responsibility Model or just brush it up a little bit, you can read our detailed blog post, where we have covered all the key elements you should know about what the Atlassian Cloud Security Shared Responsibility Model<\/a> is. <\/p>\n\n\n\n

Atlassian Data Protection Gaps: the key analysis<\/h2>\n\n\n\n

Atlassian has backups of its entire service and makes snapshots retained for 30 days (but to support only their infrastructure to work smoothly!). Customers, in their turn, should think about backup of their account data by themselves, as Atlassian has limited recovery capabilities: you can restore your data only within 60 days after you delete it. Here is what Atlassian states in its Security Practices<\/a>: <\/p>\n\n\n\n

\u201cWe do not use these backups to revert customer-initiated destructive changes, such as fields overwritten using scripts, or deleted issues, projects, or sites. To avoid data loss, we recommend making regular backups.\u201d<\/em><\/p>\n\n\n\n

So, as we can see, even Atlassian suggests its customers back up their critical data on a regular basis. It\u2019s important as Atlassian, like other cloud service providers, has its data protection gaps that refer to potential security risks and vulnerabilities in protecting data, and following privacy policies of all Atlassian cloud products (You can find out more about vulnerabilities that Atlassian faced in 2022 in our blog post – 2022 in a nutshell: Atlassian outages and vulnerabilities<\/a>). <\/p>\n\n\n\n

These gaps may appear because of a number of factors. To get a better understanding of the mentioned gaps, let\u2019s dive into them one by one. <\/p>\n\n\n\n

Improper data access controls<\/h3>\n\n\n\n

Sometimes it happens your team configures the access controls incorrectly. It can happen due to different factors: inattentiveness, or misunderstanding of the importance. Anyway, it could lead to the possibility of unauthorized users accessing your company\u2019s sensitive data. <\/p>\n\n\n\n

Insufficient logging and monitoring<\/h3>\n\n\n\n

If you don\u2019t have reliable procedures to capture and monitor logs properly, your organization may experience difficulties to identify and respond to potential cloud security threats. For example, if an attacker gains access to a system and manages to make changes to files of configuration settings, having insufficient logging and monitoring may not capture the event. Thus, it will be even more difficult to identify the source of the attack and determine the extent of the damage. <\/p>\n\n\n\n

Accidental deletion of your critical data<\/h3>\n\n\n\n

We have already mentioned that Atlassian keeps your deleted data only for 60 days. But what if somebody from your team has accidentally deleted critical information and nobody has noticed it on time (as they were working on some other project, for example)? In this case, your data may go forever without any possibility to restore it.  <\/p>\n\n\n\n

Data changes performed in bulk are to be reverted back<\/h3>\n\n\n\n

If some bulk changes are made to your Atlassian data that should not have been made, it can lead to inaccurate or incomplete data, which, in its turn, can cause problems down the line and impact your company\u2019s business operations. Why? Because reverting bulk changes can be a time-consuming and resource-intensive process, especially if those changes have been made to a large dataset. Moreover, it can be difficult to revert bulk changes if the organization doesn\u2019t have proper backup or version control in place. <\/p>\n\n\n\n

To avoid such problems caused by bulk changes that need to be reverted back, it\u2019s important for your organization to have proper data management, version control procedures, backup, and track of changes to ensure that all of them are properly documented and reviewed before being made. <\/p>\n\n\n\n

You can read more about the ways to revert a file<\/a> to the previous commit in our blog post.\u00a0<\/p>\n\n\n\n

Outdated security protocols<\/h3>\n\n\n\n

Actually, it is one of the main cloud security tips to update the products you use regularly. Atlassian constantly improves its products and releases security patches and protocols to help its customers mitigate security vulnerabilities to known security threats. <\/p>\n\n\n\n

Read about other cloud security tips in our blog post – Atlassian Security Best Practices<\/a>. <\/p>\n\n\n\n

Regulated and compliance-related requirements<\/h3>\n\n\n\n

Every company keeps its data for some time which is called the company\u2019s retention policy. It can be due to its organizational, security, and compliance requirements, or due to the need of passing security audits, like ISO 27001 or SOC 2.  <\/p>\n\n\n\n

On our blog posts about ISO 27001<\/a> and SOC 2<\/a>, you can learn more about those audits and our way to pass those certifications.  <\/p>\n\n\n\n

Inadequate backup and recovery procedures<\/h3>\n\n\n\n

If backups are not taken regularly or if they aren\u2019t stored securely, it could result in data loss when an event of a disaster or security breach occurs. For example, to be sure that your Jira, Bitbucket, or Confluence data is safe and sound, your backup should include the following features: <\/p>\n\n\n\n