Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsSpecial offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Hardening a self-managed Atlassian Data Center deployment comes down to eight areas: patch promptly, lock down the hosts, database and network, run the application with least privilege, separate authentication from authorization, restrict administrative access, log and monitor, keep tested backups, and rehearse incident response. Atlassian’s own guidance is built on shared responsibility. Atlassian ships secure releases and documentation. You protect the infrastructure and you configure, monitor, back up and recover your deployment. Atlassian states that it does not take responsibility for self-managed hardware infrastructure.
This checklist follows Atlassian’s Data Center security checklist and shared responsibilities page (last modified February 23, 2025), its SAML SSO documentation (last modified October 2, 2025), its Jira secure administrator sessions page (last modified July 1, 2024) and its Confluence security best practices (last modified December 10, 2024). Product behavior differs, so version-specific points are flagged. Confirm defaults and version support against your own release before you turn any item into a change ticket. This is a summary of official guidance, not the result of a hands-on assessment.
As an Amazon Associate I earn from qualifying purchases.
Who owns what: the shared responsibility split
Treat the split as the scope of your audit. Anything in the “customer” column is yours to check, evidence and repeat.
Recommended Free Tools
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
| Area | Atlassian provides | You are responsible for |
|---|---|---|
| Software | Releases, security fixes, advisories, hardening guidance | Applying fixes, staying on supported versions, vetting third-party apps |
| Infrastructure | Nothing for self-managed hardware | Servers, storage, network, OS, database, physical and virtual access |
| Configuration | Documented options and defaults | Identity, permissions, admin access, logging, proxy and firewall rules |
| Recovery | Backup and restore documentation | Running, protecting and testing backups; incident response |
1. Plan and patch
Build an inventory
- List every Atlassian product (Jira, Confluence, Bitbucket, Bamboo, Crowd and any others), with its exact version.
- Record operating systems, Java and other dependencies, the database engine and version, and the reverse proxy or load balancer.
- Record every installed app (plugin), its vendor, and its update status.
- Record every externally reachable endpoint, including admin paths, REST APIs and webhooks.
Track advisories and patch quickly
- Subscribe to Atlassian’s security advisory alerts so a fix does not depend on someone noticing a news item.
- Define a patch window for security fixes and write down who can approve an emergency change.
- Stay on supported releases. Atlassian also recommends considering its Long Term Support releases if frequent upgrades are hard for you. Check the current lifecycle and end-of-life dates for each product and version you run on Atlassian’s own lifecycle pages, because those dates are not covered by the guidance summarized here.
- Keep operating systems and software dependencies on supported versions. An unpatched OS or runtime undoes a patched application.
2. Protect hosts, database and network
Network placement
- Put application, database and storage tiers on appropriately private networks.
- Limit inbound firewall rules to the application traffic and management traffic that is actually needed.
- Where it suits you, route administrative paths over a VPN rather than exposing them directly.
Servers and storage
- Restrict physical and virtual access to servers and storage, and use encryption where your policy requires it.
- Install from a secure environment that is isolated from public networks where practical.
- Document the configuration you intend to have, so you can compare against it after every upgrade or migration.
Database
- Give the database service account only the privileges the application needs.
- Allow database connections only from the application hosts.
3. Install with least privilege
- Run the application under a dedicated non-root account.
- Restrict filesystem access to the installation, home (data) and storage directories to that account and the administrators who need it.
- Monitor application binaries for unexpected changes (file integrity monitoring is the usual approach). Atlassian’s Confluence guidance includes this.
4. Authentication and authorization
Use SAML SSO where it fits, and understand what it does
Atlassian’s SAML SSO app handles authentication only. It does not grant authorization. After you connect an identity provider (IdP), you still assign application access and configure groups, roles and permissions in the directory or in each application. A user who signs in successfully through SSO but sits in no group should have no meaningful access. Verify that this is what happens.
#1 Best Overall
Yubico - Security Key C NFC - Basic Compatibility - Multi-Factor authentication (MFA) Security Key and passkey, Connect via USB-C or NFC, FIDO Certified
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
The SSO documentation (last modified October 2, 2025) lists these minimum versions:
| Product | Minimum version listed for the SAML SSO app |
|---|---|
| Jira Software Data Center | 8.15 or later |
| Jira Service Management | 5.15 or later |
| Bitbucket Data Center | 7.12 or later |
| Confluence Data Center | 7.12 or later |
| Bamboo Data Center | 8.1 or later |
| Crowd | 7.1 or later |
Support can change, so re-read Atlassian’s page against your exact version. Atlassian names IdPs it has tested, and says the app should work with any IdP that implements the SAML 2.0 Web Browser SSO Profile with HTTP POST binding. SAML IdPs are not interchangeable in their configuration details, so test your specific one.
Rank #2
Yubico - YubiKey 5 NFC - Multi-Factor authentication (MFA) Security Key and passkey, Connect via USB-A or NFC, FIDO Certified - Protect Your Online Accounts
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Use HTTPS for the application, for the IdP connection, and for the application base URL.
- Test fallback access before a broad rollout, and document the recovery path. Atlassian documents SAML fallback mechanisms per product, and the implementation differs between them, so test the one for each product you run.
- If you plan hardware security keys for MFA, confirm support with your IdP. Atlassian’s guidance supports two-step verification but does not validate specific keys for a given deployment.
Tokens, basic authentication and leavers
- Prefer personal access tokens for integrations where the product supports them.
- Disable basic authentication where your SSO and token arrangement and your integrations allow it. Inventory integrations first so you do not break a build server or script.
- Disable accounts promptly when people leave, and review powerful group memberships on a schedule.
Privileged accounts
- Keep the number of administrators small.
- Use separate daily and administrative accounts where applicable.
- Avoid shared administrator accounts and easily guessed admin usernames.
- Do not grant system-admin permission to broad groups.
5. Lock down administrative access
Secure administrator sessions
In Jira, secure administrator sessions (websudo) require re-authentication before administrative functions are reachable. Atlassian documents this as enabled by default, with a rolling timeout of 10 minutes (Jira page last modified July 1, 2024). Jira also offers a websudo IP allowlist for certain superuser operations. Behavior and options may differ in Confluence and other applications, so check each product rather than assuming parity.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Restrict where admins can connect from
- Limit administrative interfaces to approved IP addresses, using the websudo allowlist or the reverse proxy, whichever the product supports.
- Combine this with VPN access for administrators working remotely.
Reduce brute-force and abuse exposure
- Consider a web application firewall (WAF) for common web attack classes. Tune it to your deployment. Atlassian’s guidance does not present it as a substitute for secure configuration or patching.
- Use login CAPTCHA, Fail2Ban or rate limiting where appropriate, for example against brute-force logins or anonymous REST abuse. Confirm the product-specific feature, and test that legitimate users and integrations are not locked out.
6. Audit apps, logs and monitoring
- Apps: third-party apps add code, access and risk. In each recurring audit, record who owns every app, whether it is still needed, and whether it is current.
- Audit log: review audit-log settings so important administrator and user events are captured.
- Access logs: protect logs from public access and watch them for unusual activity.
- Retention: if you need a longer investigation history than the product keeps, move retained logs to alternate storage.
7. Back up, restore and upgrade safely
Choose the right backup method
| Method | Atlassian’s position |
|---|---|
| Native database backup tools | A more secure, consistent and reliable way to back up and restore active instances |
| XML database backups | May be inconsistent if the database changes during the backup |
- Store backup files securely and redundantly. Backups contain everything an attacker would want, so apply the same access controls as production.
- Test restores on a schedule. A successful backup job is not proof you can recover.
- After a major upgrade or migration, revisit both backup and security settings and compare them with your documented baseline.
8. Prepare for a suspected compromise
Write the plan before you need it. Atlassian’s guidance outlines this sequence:
Rank #3
Yubico - YubiKey 5C NFC - Multi-Factor authentication (MFA) Security Key and passkey, Connect via USB-C or NFC, FIDO Certified - Protect Your Online Accounts
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Isolate the affected system.
- Preserve logs and other evidence before changing anything you do not have to.
- Change administrative passwords and review user accounts.
- Scope the incident: what was accessed, and what content was exposed.
- Check repositories for committed credentials, then rotate every exposed credential.
- Restore or rebuild from backups, as appropriate.
- Communicate with affected stakeholders.
- Review the root cause and feed the findings back into this checklist.
Turn it into an audit
For each control, name an owner and keep one piece of evidence. This table is a starting template.
Quick Recap
Bestseller No. 1
Rank #4
Yubico - Security Key NFC - Basic Compatibility - Multi-Factor Authentication (MFA) Key, Connect via USB-A or NFC, FIDO Certified
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
| Control | What to verify | Evidence to keep |
|---|---|---|
| Patching | Versions are supported and current; advisory alerts reach a monitored mailbox | Inventory export, subscription confirmation, change records |
| Network | Inbound rules match necessary app and management traffic only | Firewall rule export, reviewed on a schedule |
| Service accounts | Application runs non-root; database account has minimal rights | Process owner, filesystem permissions, database grants |
| SSO | Product version supported; HTTPS base URL; fallback access tested | Test log of fallback sign-in, recovery runbook |
| Authorization | Groups and permissions are set; no broad system-admin groups | Group membership review |
| Admin access | Secure admin sessions on; admin paths limited to approved IPs where supported | Configuration screenshots or exported settings, proxy rules |
| Apps | Each has an owner and a current version | App register |
| Logging | Audit events captured; logs not publicly reachable; retention meets need | Log settings, retention policy |
| Backups | Native database backups; stored securely; restore tested | Restore test report with date |
| Incident response | Plan covers isolation, evidence, credential rotation, rebuild | Runbook and last exercise date |
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
