ROLLING OUT SANTA WITHOUT FREEZING PRODUCTIVITY: TIPS FROM SECURING FIGMA'S FLEET

Summary from the TLDR InfoSec newsletter

Figma successfully deployed Santa, an open-source binary authorization tool, across all employee laptops by running it in monitoring mode for months to build a comprehensive allowlist based on actual usage patterns. It minimized user disruption through a custom Slack-based self-service system that allows employees to quickly approve blocked applications after automated security checks, as well as an escape hatch that enables temporary monitoring mode during rollout. The phased deployment began with users having zero unknown binaries and gradually expanded to 100% coverage over three months, utilizing automated package rule generation and group-based policies to handle edge cases, such as developer tools.