Hacker News Reader

Comment by koolba | Hacker News Reader

Restricting the IP of your internal servers goes a long way for defense in depth. It’s not a panacea, but it prevents immediate owned to the world.

View on HN

I’m not sure which IP you are restricting - it’s a cloud based service, so, by definition, your clients are pretty much anywhere on the Internet. What would you restrict?

Honestly I don't see how we could use the cloud version unless we could at least lock it down the same way we do behind a firewall; VPN or office only.

Guess it's on the roadmap, like everything else. https://confluence.atlassian.com/confeval/other-atlassian-ev...

It's weird - the last company I worked at (and ran IT for about 4 years had everything behind a firewall (like you are describing) - the current gig that I started at about 18 months ago (with about 80 employee) - no concept of a firewall. The entire office just sits behind a Comcast Modem. There is nothing to firewall. Atlassian/Salesforce/GitHub/CircleCI/Gmail/GoogleDocs/Drive/Slack/Lots of K8S and about 15-20 other cloud services make up our "IT" environment. There is zero difference to working from home to working from the office from a tech perspective.

Defense in depth is always a nice thing to have but it hardly seems like a requirement since the reason you lock down services behind a firewall is supposed to be because they're aren't hardened enough to be on the public internet. I don't think that would describe the Atlassian suite who probably has better SecOps than most of their customers.

Except when they deliberately make their product obtuse and allow customers to expose their data to the entire world.

The post you replied to mentions other methods to separate a service, not being hardened enough is only one of the reasons you would want to do that. A major one being that many Jira deployments are only useful internally anyway so there is no reason to expose it to the outside world.

JIRA can also be run on your own servers and then you can do whatever IP whitelist you want in front of it, or just not put it on the public internet at all and require VPN...

If you can use it, Cloudflare Access is great for these types of situations.

Maybe not perfect with hosted cloud servers (as opposed to your own origins), but a good start!

Reply on news.ycombinator.com