0

I want to have Altassian host a Confluence server for me. However, I can't tell if it is secure enough for:

  1. ITAR sensitive information
  2. EAR sensitive information
  3. Intellectual Property / Trade Secret

I've heard all the usual arguments that IT security is better to outsource and it is more secure than on-premises. I've heard all the arguments that if it is good enough for (fill in the blank) company it must be good enough for you.

When it comes down to ITAR / EAR, you are personally liable. That means, you go to jail, not the company.

When you post a customer's Confidential Information, your NDA / CDA specifies that you are responsible and can be sued.

Atlassian did not respond to the question above. So, I'm left to my own devices to figure out if it is secure enough.

What is the best way to resolve this issue?

Is there a government / private organization that sets a standard for security that warrants whether certain cloud services are sufficient for ITAR / EAR / IP? Can I rely upon this in a court of (U.S.) law?

| improve this question | |
  • 2
    The government system for determining "is it secure enough as a cloud service" is FedRAMP. – Monica Apologists Get Out Mar 22 '18 at 21:58
  • Already asked FedRAMP. Their answer was very vague and wound up being check with the vendor of the cloud service. That's not very helpful to me - sounds like the wolf watching the hen house. I won't get a straight answer from the vendor of the cloud service. – user3533030 Mar 23 '18 at 4:14
1

Without being overly familiar with ITAR and EAR (I'm not an American), I'd suggest that if Atlassian have not responded to your concerns you would be unwise to host in their cloud.

Nothing below is to imply Atlassian are reckless with your data - if anything the reverse - by comprehensively describing their practices they can help you make an informed decision.

Read through https://www.atlassian.com/trust/security/security-practices#faq-49b1539c-bbea-405e-a8a4-1b5c7cb49b39 which I imagine will give you pause. Among other things that might concern me -

  • Confluence data is not stored encrypted.
  • They use geographically diverse DC's - including DC's outside USA, and it is strongly implied data is shared between multiple availability zones, which could imply outside the USA.
  • Their emoyees have (controlled) access to your data. It is not guaranteed your employees are US citizens.

If you can be compliant bearing in mind the limitations they disclose, it could be more secure to use their system - It probably comes down to if US clearances are needed, if data can be stored outside USA, and if you need to protect against foreign state actors.

| improve this answer | |
  • I used to work with ITAR/EAR data. Any of your three bullet points is a pretty big "No." IRT uploading stuff to that service. – Monica Apologists Get Out Mar 22 '18 at 21:57
  • This is a pretty compelling response. The simple answer is that it is not stored in an encrypted fashion. aws.amazon.com/compliance/itar is supposed to be ITAR compliant, but it is not a collaboration tool like Confluence. – user3533030 Mar 23 '18 at 4:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.