Simplifying Device Management: How Atro Revolutionized Security

Introduction

In today's interconnected world, ensuring the security of devices used by organizations is of paramount importance. At Atro, we embarked on a mission to make device security accessible to everyone, regardless of their level of technical expertise. Our vision was clear: to empower organizations to effectively manage their devices and enhance security measures without the need for complex IT or security knowledge. This is the story of how we turned this vision into a reality.

‍

Inspiration and Vision

Our Inspiration

Our journey began with a simple but powerful inspiration – the desire to keep people safe in the digital realm. Organizations small and large often faced similar challenges in bolstering their security posture. While many organizations had lofty goals for securing their devices, the complexity of the task often led to confusion and frustration. We aimed to provide a solution that was both secure and simple, allowing companies to quickly identify, manage, and remediate security risks across their devices.

Organizational Goals

From the outset, our mission was clear. We wanted to create a device management system that was non-invasive, privacy-focused, and capable of actually managing devices, not just reporting their states. We asked ourselves, "Could we simplify this process and make it as easy as possible for our users?"

‍

We asked ourselves, "Could we simplify this process and make it as easy as possible for our users?"

‍

Learning from the Best

We drew inspiration from great IT management teams (like Airbnb, Facebook) that use Infrastructure as Code (IaC) to manage their fleets of devices. However, rolling out a device management strategy can often take significant coordination and technical resources. We wondered, why couldn't we achieve the same results through automation and a user-friendly interface?

‍

Planning and Research

The Landscape

We delved into the existing strategies that use Infrastructure as Code (IaC), Mobile Device Management (MDM), and device management. We explored how others had approached this challenge, the hurdles they encountered both technically and politically, and how we could make a difference.

User Insights

To gain a deep understanding of the real-world needs of organizations, we engaged with hundreds of small companies. One recurring theme was the need for effective device management, without the hassle. We found that organizations at varying growth stages did not have the resource availability to implement device management at scale, and wanted a simpler approach that they could deploy with ease.

Choosing the Right Tools

Armed with insights, we set out to design and develop our system, carefully selected the technology stack. We decided to leverage Electron, Osquery, The Update Framework (TUF), and  Salt to create a powerful framework that would simplify device management in an easy to use interface.

‍

Electron is a open-source tool for building cross platform desktop applications, allowing Atro to provide a simplified interface for gathering, managing, and reporting device security controls to an organization. Users can simply run our software, and get actionable results immediately without any requirement for technical ability.

‍

Osquery is an open-source endpoint visibility tool that allows for non-intrusive device introspection, allowing Atro to check for various security configurations on device. It is cross-platform, community loved, and has been reliably deployed at scale across hundreds of organizations for a variety of use-cases such as incident response, compliance audits, or general device security and configuration reviews.

‍

The Update Framework is  an open source framework for securing software update systems. We embraced this framework to handle offline signing and profile management when checking devices for security configurations.

‍

Challenges and Solutions

Overcoming Hurdles

Naturally, building a new device management system came with its share of challenges but the Atro engineering team was up for the challenge! To briefly name a few, we had to navigate UNIX web sockets for a variety of internal use cases, provide an over-the-air update framework for pushing new device profiles and policies, and handling WAN-based agents. Additionally, we encountered a variety of bootstrapping issues, as well as ensuring that we could reliably affect the state of machines securely.

‍

The TUF Framework

To address these challenges, we embraced The Update Framework (TUF) with offline signing and profile management. We also introduced a standalone mode for Osquery and Salt, enhancing the flexibility and security of our solution.

‍

Collaboration and Team Efforts

Team Synergy: Collaboration was at the heart of our success. Our team's diverse strengths played a pivotal role in bringing Atro to life. Kasey and Mark’s expertise in opsec and devops, Philipp's security-focused engineering, and Jonathan's ability to simplify Electron all contributed to our achievement.

‍

Testing and Quality Assurance

Rigorous Testing: Ensuring the security and reliability of our system was non-negotiable. We subjected Atro to rigorous security testing and quality assurance processes to guarantee that our users could trust their devices in our hands.

‍

‍

‍

‍

Launch and Deployment

Unveiling Atro: Launch day was an exciting milestone. We considered platforms like Hacker News and Product Hunt to introduce Atro to the world. Early user feedback played a crucial role in refining our offering.

‍

Customer Feedback and Improvements

Listening to Our Users: We listened attentively to customer feedback and used it to drive improvements. Major iterations and upgrades followed the initial launch, ensuring that Atro continued to meet the evolving needs of our users.

‍

Lessons Learned

Reflecting on the Journey: Building Atro was a journey filled with valuable lessons. We learned from our successes and the challenges we faced. One key takeaway was that simplifying complex processes is not just a goal; it's a mission.

‍

Conclusion

Empowering Security: Atro's device management system has revolutionized the way organizations approach security. We've made it possible for millions of users to achieve the correct security configurations on their devices without needing advanced IT or security knowledge.