3 ms·

I’m not sure which IP you are restricting - it’s a cloud based service, so, by definition, your clients are pretty much anywhere on the Internet. What would yo

I’m not sure which IP you are restricting - it’s a cloud based service, so, by definition, your clients are pretty much anywhere on the Internet. What would you restrict?

javagram 7y ago
JIRA can also be run on your own servers and then you can do whatever IP whitelist you want in front of it, or just not put it on the public internet at all and require VPN...
bearer_token 7y ago
Honestly I don't see how we could use the cloud version unless we could at least lock it down the same way we do behind a firewall; VPN or office only. Guess it's on the roadmap, like everything else. https://confluence.atlassian.com/confeval/other-atlassian-evaluator-resources/can-i-restrict-by-ip-in-atlassian-cloud https://confluence.atlassian.com/confeval/other-atlassian-ev...
- Spivak 7y ago
  Defense in depth is always a nice thing to have but it hardly seems like a requirement since the reason you lock down services behind a firewall is supposed to be because they're aren't hardened enough to be on the public internet. I don't think that would describe the Atlassian suite who probably has better SecOps than most of their customers.
  - Aeolun 7y ago
    Except when they deliberately make their product obtuse and allow customers to expose their data to the entire world.
  - tastroder 7y ago
    The post you replied to mentions other methods to separate a service, not being hardened enough is only one of the reasons you would want to do that. A major one being that many Jira deployments are only useful internally anyway so there is no reason to expose it to the outside world.
- ghshephard 7y ago
  It's weird - the last company I worked at (and ran IT for about 4 years had everything behind a firewall (like you are describing) - the current gig that I started at about 18 months ago (with about 80 employee) - no concept of a firewall. The entire office just sits behind a Comcast Modem. There is nothing to firewall. Atlassian/Salesforce/GitHub/CircleCI/Gmail/GoogleDocs/Drive/Slack/Lots of K8S and about 15-20 other cloud services make up our "IT" environment. There is zero difference to working from home to working from the office from a tech perspective.
anthonys 7y ago
If you can use it, Cloudflare Access is great for these types of situations. Maybe not perfect with hosted cloud servers (as opposed to your own origins), but a good start!

I’m not sure which IP you are restricting - it’s a cloud based service, so, by definition, your clients are pretty much anywhere on the Internet. What would you restrict?

javagram 7y ago

JIRA can also be run on your own servers and then you can do whatever IP whitelist you want in front of it, or just not put it on the public internet at all and require VPN...

bearer_token 7y ago

Honestly I don't see how we could use the cloud version unless we could at least lock it down the same way we do behind a firewall; VPN or office only. Guess it's on the roadmap, like everything else. https://confluence.atlassian.com/confeval/other-atlassian-evaluator-resources/can-i-restrict-by-ip-in-atlassian-cloud https://confluence.atlassian.com/confeval/other-atlassian-ev...

Spivak 7y ago
Defense in depth is always a nice thing to have but it hardly seems like a requirement since the reason you lock down services behind a firewall is supposed to be because they're aren't hardened enough to be on the public internet. I don't think that would describe the Atlassian suite who probably has better SecOps than most of their customers.
- Aeolun 7y ago
  Except when they deliberately make their product obtuse and allow customers to expose their data to the entire world.
- tastroder 7y ago
  The post you replied to mentions other methods to separate a service, not being hardened enough is only one of the reasons you would want to do that. A major one being that many Jira deployments are only useful internally anyway so there is no reason to expose it to the outside world.
ghshephard 7y ago
It's weird - the last company I worked at (and ran IT for about 4 years had everything behind a firewall (like you are describing) - the current gig that I started at about 18 months ago (with about 80 employee) - no concept of a firewall. The entire office just sits behind a Comcast Modem. There is nothing to firewall. Atlassian/Salesforce/GitHub/CircleCI/Gmail/GoogleDocs/Drive/Slack/Lots of K8S and about 15-20 other cloud services make up our "IT" environment. There is zero difference to working from home to working from the office from a tech perspective.

anthonys 7y ago

If you can use it, Cloudflare Access is great for these types of situations. Maybe not perfect with hosted cloud servers (as opposed to your own origins), but a good start!