A friend's start-up has implemented a number of business critical services on a Hudson/Jenkins server run on a Tomcat container. This is not an open-source project, in fact many aspects of this project are confidential. Jenkins is used primarily as a means of running batches & gthering results from those batches.
To some-extent the system has been locked down, for example a plugin has been installed which is intended to block brute-force password guessing attacks. The Jenkins system has been configured to the only thing you can see before you log-in is a login screen, hence these users can re-configure or run anything on the Jenkins server.
The question: Does this system pose any significant security threat to the business? Have we taken all the relevant, reasonable security measures.
For example, it's possible that some kind of as-yet unknown vulnerability in the stack might become the basis of an exploit, but how concerned should we be about a risk which is at best unquantifiable, at worst only theoretical?