## Protect users of Jenkins from other threats 

There are additional security subsystems in Jenkins that protect Jenkins and users of Jenkins from indirect attacks. 

The following topics discuss features that are off by default . We recommend you read them first and act on them immediately. 

• CSRF Protection --- prevent a remote attack against Jenkins running inside your firewall. This feature is off by default  in Jenkins 1.x and when upgrading to 2.x. 

• Security implication of building on master --- protect Jenkins master from malicious builds 

• Slave To Master Access Control --- protect Jenkins master from malicious build agents 

The following topics discuss other security features that are on by default. You’ll only need to look at them when they are causing problems. 

• Configuring Content Security Policy --- protect users of Jenkins from malicious builds 

• Markup formatting --- protect users of Jenkins from malicious users of Jenkins 

