figmaJul 1, 2025

Rolling Out Santa Without Freezing Productivity: Tips from Securing Figma’s Fleet | Figma Blog (opens in new tab)

Figma rolled out Santa, an open-source macOS binary authorization tool, across its laptop fleet without significantly disrupting employees. The company combined file access controls, monitoring mode, data-driven allowlists, and a staged deployment strategy to improve endpoint security while preserving productivity. Its experience shows that binary authorization works best as one layer of a broader, user-conscious security program. ## Binary Authorization as Part of Endpoint Security - Binary authorization limits devices to running approved applications, reducing the attack surface for malware-based attacks. - It does not control scripts, extensions, plugins, or other non-binary code, so it cannot replace layered endpoint defenses. - Santa supports: - **Binary rules** based on SHA-256 hashes for precise integrity checks. - **TeamID rules** for all applications signed by an Apple developer team. - **SigningID rules** for a specific developer identity and application. - **Compiler/transitive rules** for binaries produced by approved compilers. - **PathRegex rules**, which should be used cautiously because paths can be bypassed. - Santa also provides file access authorization, allowing organizations to restrict which applications can access sensitive files. ## Securing Browser Cookies First - Figma initially used Santa’s file access authorization to protect browser cookies. - Access was restricted to the browser application, reducing the risk of credential theft by malicious scripts or unauthorized processes. - Because this protection had almost no effect on employee workflows, it provided a low-risk early success before introducing binary execution controls. ## Building an Allowlist with Monitoring Mode - Figma deployed Santa in monitoring mode across its fleet before blocking anything. - Monitoring recorded binary executions and exposed how employees actually used software. - The security team began with **TeamID** and **SigningID** rules for approved applications such as Zoom, Slack, Chrome, Notion, and GitHub. - These broad signing-based rules covered most executions while allowing Figma to investigate exceptions and refine its policies before enabling lockdown mode. - The collected data helped the team prepare for blocking unapproved binaries with minimal disruption. ## Balancing TeamID and SigningID Rules - Figma’s allowlist design required weighing broader publisher-based trust against more narrowly scoped application identities. - TeamID rules can efficiently authorize applications from a trusted developer, while SigningID rules provide tighter control over specific products or signing identities. - Choosing the appropriate rule type was an important part of creating a secure allowlist that would not unnecessarily block legitimate work. Figma’s approach recommends starting with protections that are nearly invisible to users, gathering real execution data in monitoring mode, and only then progressing toward lockdown with carefully scoped rules and staged rollout controls.

endpoint-securitymacossantabinary-authorization+2

figmaApr 3, 2025

Designing for Security and Usability: Figma's Modern Endpoint Strategy | Figma Blog (opens in new tab)

Figma argues that effective endpoint security must balance strong controls with a smooth employee experience. Excessive friction encourages unsafe workarounds and noncompliance, while self-service remediation and data-driven rollouts make security easier to adopt. Its strategy combines automated device quarantine, application allowlisting, and just-in-time access controls to protect systems without unnecessarily disrupting productivity. ## Security and usability must work together - Strict policies alone do not guarantee safety. - Complicated password rules, for example, can lead employees to reuse passwords or write them down. - Security controls should help employees work securely rather than create incentives to bypass them. - Employee trust and participation make the overall security program more effective. ## Endpoint Security Baseline and self-service remediation - Figma’s Endpoint Security Baseline (ESB) enforces controls such as: - Keeping browsers updated - Disabling remote login - Preventing kernel extensions from running - Kernel extensions can execute code at a low system level and potentially exfiltrate data, disable protections, or steal credentials. - Using OSQuery, the ESB detects risks such as unauthorized kernel extensions. - Noncompliant devices are quarantined and blocked from privileged services including AWS, GitHub, and Google Workspace. - The system attempts automatic fixes before contacting the user. - If user action is required, Slack provides instructions and self-service remediation. - Access is restored immediately once the device returns to a safe state. ## Data-driven rollout of Santa - Santa is an open-source macOS binary allowlisting tool that permits only approved applications to run. - Figma first used Santa’s Monitor Mode to observe application usage before enabling Lockdown Mode. - The rollout revealed that: - Most non-engineering employees used a small set of standard applications. - Engineers frequently created new binaries during development. - Engineers also relied on numerous productivity tools that required review. - Figma built automated approval for developer-created binaries and reviewed commonly used tools. - The resulting allowlist meant 90% of devices would experience no blocked applications. - A Slack-based self-service approval workflow handled less common applications. - Santa was gradually deployed to experienced engineers, improving security with minimal disruption. ## Just-in-time access with Opal - Figma identifies two problematic access models: - A “Wild West” approach with few safeguards and excessive production access - A heavily process-driven model that slows employees and encourages unsafe alternatives - Overly restrictive access processes can lead to practices such as using development environments for production work or deploying shadow IT. - Figma introduces just-in-time access with Opal to seek a middle ground: controlled access that employees can request when needed, without permanent privileges. Figma’s approach recommends making security automated, observable, and self-service wherever possible. Strong controls are most effective when they protect sensitive systems while allowing employees to resolve issues and obtain legitimate access quickly.

endpoint-securitymacososquerybinary-allowlisting+3