Protecting Data Stored in Jira Project Management Applications – Greg Bak, Xopero

This is Textron TV. Hey guys. Thanks for the throw.

We're here with Greg Bach who is product development manager for gitprotect which is owned and developed by zophores software and we're gonna be talking about jira and the need to protect jira and back it up and recover and what's going on with all those issues Greg. Welcome the show. Hi.

Hello, Mike nice to see you again. And and of course, I would like also to welcome all of you who swatching our today's today's video and as he said before today, we are going to talk why and how properly protect your Chira instance. So what exactly is the challenge because we've been backing up software forever in a day.

So what makes Jerry unique and why do I maybe need a different approach than what people have been using the backup everything else that they have? Yeah, you know, especially I think each SAS application requires different approach to backup because of different API because of its limitations, but first of all, I think we need to change the way how we think about services and this is what actually is happening on the market because because very often we can hear that if some kind of service is 13 Cloud then we don't need to worry about those data that are directly in the cloud because they are safe they are secured and obviously they are in Cloud but it's not true and I think every service provides something called short responsibility model or on the other hand known also limitedly ability model so they are not responsible for protecting your data. Possible for providing infrastructure for providing service.

It's availability but in general not for your data and Think that quite often users are not aware of that so they don't know that the data are not protected. Or maybe they or maybe they are somehow protected but we found users control and in results. Sometimes they may lose their data because of some some accidents some I don't know first party actors some unwanted changes at due to some human mistakes or a lot of different reasons we can lost data.

So that's why it's so important to protect you cheera, even if it's running directly in the cloud on the other hand it became so more popular because atlassian says that they are going to to me great most of their own premise solutions to the cloud ones. So already there are a lot of users who are creating from Local jira instance to the cloud one. Where does the data get back them to if it's a SAS application because clearly it's probably not going to be on the atlassian service per se because well that might be down.

So the question is is where do I put that data? And then how do I recover it? Yes, you know when when you are when you're looking when you are thinking about about any backup solution, first of all, you must be sure that this backup software allows you to follow free to one backup rule, which requires from you to have three different copies of your data in two different locations and one at least one outside of your company or in terms of services, we can set that this one copy should be outside the service location.

So it should goes to some different infrastructure. And of course, it could be it could be some local storages like you're even localities resources on some mass for example, but also it could be it could be any public cloud like AWS as your and of course get protect all so provides you just abilities to start the data whenever you want in general we do support of course those public cloud storage as well what we are Also providing our own cloud storage from United States or email depends on on our customers region. Take two or how long does it take to recover the data because time is still money these days and people are a lot more sensitive about recovery times than they used to be.

So what exactly is involved in rehydrating the entire at Lassie and your application? So if you will take a look at the restore process we which Atlas young all those has to to follow which At Last Chance make possible to be done. It has just that the first step we've got control over and it's just data restart.

So we just needs to extract your data from backup Apple to them to a Flash and servers and this is the first step. We've got the control over time. It's usually different of cura size.

But I think it's no longer than half hour in average. We've with some big jira instances with those smaller ones. It's it's literally just few minutes and the second part of this process.

We don't have control over. It's importing data directly to jira, but in general for for instance, we we made usually with with medium-sized customers the whole restore process take up to I believe half hour in total. And in terms of cura, it's pretty fast because if we'll take a look at the outage they had in April last year and the last customers get dangera instance recovered after more than two weeks.

And and we know even the one customer who was affected for so long time with no access to to their jira because it takes them so long to restart the data because obviously of course firstly the bigger customers were handled where we start and after that those smaller ones. So that's why it took so much time for them. So in in case of such accident half hour is really great and awesome time.

Do you think that cybercriminals are targeting jira data, because so much of an organization's development efforts revolve around that. So are they looking at that as a primary target? And you know, is that something to be concerned about?

Yeah, absolutely. Absolutely. We have to because nowadays Jura becomes very powerful tool.

It's used to not only for it and not only for devops companies, but I believe today there are way more way more companies when way more markets when when we're jira is used. It's great solution for for HR processes and other processes that took places in companies when you're planning something when you need to make sure that some tasks are done properly. When you need to track any project any process not only in terms of it.

Then jira is really really great tool. I'm not sure but they are also providing some new product which can be used also to track your sales activities. And so so it can even became some kind of CRM in your future.

So so as you can see, there are a lot of valuable and in important information that can be useful by some hackers attackers and others. Why doesn't it lasting kind of address this issue or why should we think about a third party for solving this problem? Oh, it's it's a little bit tough question why they do not address this problem, but I believe and I believe in general each each SAS provider has some kind of backup under the hood, but it could be very expensive very tough and difficult task to provide such backup with full control to each single user of such services and probably maybe I guess that's why they do not provide provide this kind of services and on the other hand.

They they don't want to be I think they don't want to be responsible for the user's data and it's way easier to to give this this responsibility to to the End customer for the data and as a backup register, I know how big responsibility it is to have users data in place to keep them secure and always have a label whenever users need them. Who's ultimately making this decision? Is it the owners of the jere application or is there somebody else in it that they think is doing this on their behalf?

And is there somebody who's in charge of data protection who's supposed to be thinking about all this? Molly depends on the size of the company because with those smaller components where there are no no roles dedicated for it security usually decision is made by jira admin. So so he finds out for example that jira provides some money while backup options that you can every two days make full backup of jira.

And and if he will see how much data are changed or added daily to jira then Manuel backup made every day is not enough for such idea. I mean moreover it's worth to be added that statistics says that manual backups are usually half year old so such old backups are are useless because we are just humans we can forget about making some manual tasks and and that's why it's so important to autom Your backup to make it as frequent as as you need as important changes are made on the other hand. We in those bigger companies with dedicated security team are are at least we if we've I know seesaw Chief Information Security Officer And and persons like this that they make decisions to quite often.

The children is make even by by CTO. So by General decision makers responsible for the data security in company. Tests all this because in my experience at least a lot of the times the files are corrupted when you go to recover them, they might even be loaded up with encrypted malware and you're not going to be like with them.

So who checks on whether or not we can actually recover the time? When you need it versus sometimes, you know, when we don't look we get suppressed. Yeah, so, you know the the first fall in case of good protect our software takes care.

It takes the best care about your data. So we are we are making sure that that all checksums and every data on the storage is safe secure and properly properly written there. And of course we are using IMO table storage.

So once data are written to the storage they cannot be changed and modify. So thanks to it. We can be sure that they won't be won't be affected by any kind of molar.

But in terms of tests, it's pretty tough to make it out automatically and because jira is service hosted directly in the cloud and whenever we want to recovery we have to do it to to some new. And or existing instance, so so you have to own some additional instance, but I think in near future, we will provide such feature to git product as well because and it's worth to be mentioned that in heat protect as the end user. You can always test your jewelry store with with no additional fees because we allows you to restart the data your jira instance with now users at all and general licensing model is based of now is based on number of users you have in your jira.

So if you will restore your entire jira, but with no users then you can be sure that all data are there that they are recoverable. How long does it take and you won't be charged by atlasion for such instance of of the jira and I hope in the in the near future will provide such feature automate that in each project. All right, folks you're hurting here.

If you're devops world revolves around jira better to be safe than sorry. Great. Thanks for being in the show.

And thank you. All right back to you guys in the studio.