At monday.com, security is a top priority. We want to make sure you’re safe when you build your workflow with us. This article will answer frequently asked questions about security and IT implementation of Jira integration in the cloud and on-premises.

The basics

Who is the developer of Jira integration?

The Jira integration key (both cloud and server) is monday.com.

Who initiates the required connection to the network?

While we are the ones initiating the connection, both parties need to participate to successfully create the connection.

Identification

How is identification done in this service?

This is token-based authentication, where the user logs in to monday.com with their JIRA login credentials, and from that point on, the interaction between the two parties is managed using an access token.

Does monday.com have a binary agent to install on our network to automatically manage security components?

No. The Jira server configuration is based on typical HTTPS communication and any additional security filtering should be implemented in the user’s network firewall.

Are you using CAL for logging or have you implemented your own logging system?

We have implemented a SIEM solution, to which we transfer logs from our NIDS, traffic logs from external locations, and general identification and authorization logs, both from the application itself and from infrastructure resources. Security events are regularly reviewed by a managed SOC team and handled according to their severity.

How can we set up an integration with Jira when our instance is behind a firewall/VPN?

There needs to be some kind of internet access to integrate with the Jira server or any third party.

Additionally, the following IP ranges need to be open in your firewall/VPN for the integration to work:

• 82.115.214.0 / 24
• This range (containing 256 public addresses from 82.115.214.0 to 82.115.214.255) is used by our egress to send data to clients. This range must be whitelisted to accept incoming connections from our infrastructure.
• It is not possible to record the ingress IP addresses, which are used to receive data from clients (such as calls to our API applications) because we use Cloudfare as our edge network provider, and they can change IP addresses at any time. This should not be a problem in most cases.

Permissions

Why are global administrator privileges required?

We use JIRA’s REST API to create Webhooks and for this, the authorized credentials should be that of a JIRA administrator with global permissions.

What security measures apply?

• JIRA in the Cloud: Go to monday.com<> Third-party applications, there is no enforcement of any kind on outgoing data, and for incoming data the information is encrypted using TLS 1.2.
• JIRA Server: For JIRA Server, it depends on the local server and the person creating the integration – if the client types in a basic address that uses http, rather than https, then the communication will not be encrypted during transit. Generally if they use https (ssl), with a trusted certificate – then the data will be encrypted during transit.

For the Jira server, is the application/API only accessible internally or is it directly exposed to the internet?

monday.com is accessible from anywhere and exposed to the internet. Your JIRA server is not, as it is a local instance. So to make these two objects work together, you are asked to allow requests coming from monday.com (in the outside world) to your server.

Data transfer and storage

What data is transferred?

The data transferred is based on the mapping defined by the user when setting up the integration. The domains are issues and projects on Jira’s side, and items on our side.

What data can we access and what can we do with it (reading vs. writing)?

The answer to this question depends on the scope of the API token:

• Jira integration is a token-based integration (not Oauth2), meaning we do not request specific domains. Neither monday.com nor the user can control the domains of the API token. This is based on Jira’s settings. That is – if some permissions change after authentication, we have no control over it – whether that includes adding new API capabilities or removing them.
  • Documentation: https://support.atlassian.com/atlassian-account/docs/manage-api-tokens-for-your-atlassian-account/
• Given the above, monday.com will only access the requested data listed in the recipe. Each time the integration is run, it will attempt to fetch only the relevant data required to complete the run. We do not make unnecessary API calls to fetch unused data.