Designing for Security and Usability: Figma's Modern Endpoint Strategy | Figma Blog

Figma argues that effective endpoint security must balance strong controls with a smooth employee experience. Excessive friction encourages unsafe workarounds and noncompliance, while self-service remediation and data-driven rollouts make security easier to adopt. Its strategy combines automated device quarantine, application allowlisting, and just-in-time access controls to protect systems without unnecessarily disrupting productivity.

Security and usability must work together

• Strict policies alone do not guarantee safety.
• Complicated password rules, for example, can lead employees to reuse passwords or write them down.
• Security controls should help employees work securely rather than create incentives to bypass them.
• Employee trust and participation make the overall security program more effective.

Endpoint Security Baseline and self-service remediation

• Figma’s Endpoint Security Baseline (ESB) enforces controls such as:
  • Keeping browsers updated
  • Disabling remote login
  • Preventing kernel extensions from running
• Kernel extensions can execute code at a low system level and potentially exfiltrate data, disable protections, or steal credentials.
• Using OSQuery, the ESB detects risks such as unauthorized kernel extensions.
• Noncompliant devices are quarantined and blocked from privileged services including AWS, GitHub, and Google Workspace.
• The system attempts automatic fixes before contacting the user.
• If user action is required, Slack provides instructions and self-service remediation.
• Access is restored immediately once the device returns to a safe state.

Data-driven rollout of Santa

• Santa is an open-source macOS binary allowlisting tool that permits only approved applications to run.
• Figma first used Santa’s Monitor Mode to observe application usage before enabling Lockdown Mode.
• The rollout revealed that:
  • Most non-engineering employees used a small set of standard applications.
  • Engineers frequently created new binaries during development.
  • Engineers also relied on numerous productivity tools that required review.
• Figma built automated approval for developer-created binaries and reviewed commonly used tools.
• The resulting allowlist meant 90% of devices would experience no blocked applications.
• A Slack-based self-service approval workflow handled less common applications.
• Santa was gradually deployed to experienced engineers, improving security with minimal disruption.

Just-in-time access with Opal

• Figma identifies two problematic access models:
  • A “Wild West” approach with few safeguards and excessive production access
  • A heavily process-driven model that slows employees and encourages unsafe alternatives
• Overly restrictive access processes can lead to practices such as using development environments for production work or deploying shadow IT.
• Figma introduces just-in-time access with Opal to seek a middle ground: controlled access that employees can request when needed, without permanent privileges.

Figma’s approach recommends making security automated, observable, and self-service wherever possible. Strong controls are most effective when they protect sensitive systems while allowing employees to resolve issues and obtain legitimate access quickly.