Atlassian is the company that makes both our wiki software and the software we use for work management and ticket tracking (only really available to IT staff and from on campus), and we’re pretty fond of them. Their products aren’t perfect, but they’re among the best available and represent a huge improvement in the way we at Missouri State get our work done.
Since we work so much with their software, we of course follow the news that comes out of the company, and yesterday I received word of a security breach at Atlassian. An email sent by them stated that my account (and hundreds of thousands of others) might have been compromised and that I should change my password. Since I use a different password on their site than I use anywhere else, I didn’t worry much about it, but I still had some concerns. What does this mean for our wiki setup? Is it not secure? What happened?
Today’s blog post from Atlassian goes into more detail in regards to what happened, and in short, they simply goofed up. It’s still a big deal and they’re doing a full internal investigation, but for my purposes all I needed to know was that it doesn’t affect our wiki.
Atlassian had migrated their login database (where account names and passwords were stored) to an encrypted area, but left the legacy system sitting out there unencrypted. They forgot to delete that legacy system, and someone finally got to it, which is the security breach in question. At Missouri State University, our database is already on a secure server, but beyond that we don’t store login information through Confluence (the wiki software in question) itself. Instead, we authenticate against the Active Directory, which is why everyone is able to log in with their regular username and password.
I’m confident Atlassian will get this sorted on their end, and they’ve already gotten the security issues taken care of. As for us, our system is set up differently, and its security is still solid.
Tagged with: atlassian, confluence, encryption, jira, passwords, Security
Matthew Stublefield — Meyer Library 207
Matthew is a Lab Support Administrator with Missouri State University Computer Services. To read more of Matthew's articles, check out Matthew's profile and archive.