TechPrufer
Get started
Atlassian
Atlassian logoAtlassian · Feature trail

Cloud Product Security Practices

4 posts · Aug 2013 – Sep 2024

What this trail covers

Atlassian's cloud products are enhanced with advanced security features including mandatory two-step verification (2FA) and IP whitelisting for teams. These features aim to bolster account security beyond passwords, protecting private code and sensitive data from unauthorized access. The Premium plan offers these capabilities, alongside other administrative and performance features, to support growing teams with complex security requirements. This post introduces two-step verification (also know as MFA) and IP allowlisting as configurable security controls within Bitbucket Cloud, complementing platform-level security measures like encryption and RBAC. It also details CI/CD integrations for security scanning (secret, infrastructure-as-code, and dependency scanning) and workspace-level merge checks to enforce security policies at scale.

All Atlassian trails
  1. Keeping your code secure in the cloudThis post details the implementation of IP allowlisting and mandatory 2FA as configurable security controls within Bitbucket Cloud. It also highlights the integration of security scanning tools (secret, IaC, dependency scanning) and workspace-level merge checks into CI/CD pipelines to enforce security policies at scale. The post also mentions platform-level security practices such as data encryption, multi-region hosting on AWS, and role-based access control for internal staff.
  2. 7 non-negotiable security practices for any cloud productThis post details 7 key security practices for cloud products: 1. Tracking access and usage across cloud providers using Atlassian Organizations. 2. Managing access to sensitive data with granular permissions and regular audits. 3. Automating user provisioning and de-provisioning via SCIM or G Suite sync. 4. Configuring SSO with identity providers (SAML or G Suite). 5. Educating teams on security best practices and setting login requirements (password policies, 2SV, API tokens). 6. Routinely auditing activity logs in Confluence and Jira. 7. Familiarizing with cloud provider security offerings and Atlassian's Trust Center.
  3. Leveling up your Cloud security with 2FA and IP WhitelistingThis post introduces two significant security enhancements for Bitbucket Cloud: required two-step verification (2FA) and IP whitelisting. Required 2FA ensures all team members enable two-step verification to access private content, acting as a critical defense against password compromise. IP whitelisting restricts access to private repositories and other account content to a predefined set of IP addresses, providing an additional layer of security against unauthorized access even with stolen credentials. These features are part of the Bitbucket Premium plan and are presented as solutions for teams with stringent security needs, particularly those migrating from on-premise solutions.
  4. Two-step verification is hereIntroduced two-step verification (2FA) for Bitbucket accounts, built on the Time-based One-time Password Algorithm (TOTP). This feature is optional and accessible via account settings.
  5. New audit logs give you the who, what, when, and whereThis post introduces audit logs for Bitbucket accounts, recording changes made to personal and team accounts. It details the types of events logged, including basic account information updates, email address changes, third-party account linking, OAuth service integrations, group and access list changes, and repository creation/deletion. The IP address associated with each change is also recorded.