Lightrun Security

Lightrun Does not Have Access to Your Source Code

Lightrun utilizes the developers’ existing IDE and therefore the customer’s source code does not leave its infra. Only the customer has access to the source code, at all times. The Lightrun architecture ensures the customer manages the code and Lightrun’s components end-to-end effortlessly. The Lightrun Sandbox ensures no changes to the code state and thresholds cap usage overhead.

Authentication and Access Management

Only registered, authenticated and authorized users are able to access and leverage Lightrun. Upon installation of the Client Plugin, users undergo a self-service registration process in which a unique username and password are created. Lightrun uses an Identity and Access Management framework and enforces strict password policy with a minimum length of 8 characters and full complexity. The passwords are securely stored hashed and salted, in accordance with NIST requirements.

Once logged in, each user is provisioned with a unique JWT. The Client component and users communicate with Lightrun using a short lifespan JWT token that requires re-authentication once in a defined period.

Secure Product Development Lifecycle

Lightrun invests significant efforts to help ensure its product and system components are well protected and in alignment with the security industry’s best practices. Once a year, critical components within the Lightrun product undergo a Secure Design Review. In addition, all system components undergo security penetration tests on a regular basis by an independent third party, and the source code is scanned with static code analysis tools to help proactively identify potential security vulnerabilities. The Lightrun internet-facing components undergo vulnerability scans on a daily basis to help proactively identify potential issues.

Agile Deployment Models: On-premise or Customer Private Cloud

Lightrun is installed in an on-premise mode within the organizational network or through a private cloud via Docker or Kubernetes. The customer IT or DevOps team is responsible for the ongoing maintenance, as with any other internal/local resource. In addition, all existing organizational security controls and policies automatically apply to all of Lightrun’s components.

Encrypted Communication

The communication between all Lightrun components and the management server is always established over industry standard TLS 1.2 encrypted channels. Certificate pinning is utilized both in the agent and the client.

Role Based Access Control (RBAC) and Single Sign-on

Lightrun provides several types and levels of roles to help support granular management and segregation of duties. The roles introduce various permission levels ranging from the highest level of System Administrator, Manager, and Standard User. In addition, Lightrun is actively developing a Single Sign On module to help customers leverage the existing organizational user directory and repository.

Self-Defense Mechanisms and PII Redaction

The Lightrun agent has a built-in sandbox mechanism designed to help achieve minimal impact and prevent any unwanted side effects. In addition, Lightrun supports file and function level blacklisting, which allows the system administrators to restrict access to certain resources or use the Personal Data Fencing feature to restrict access to certain types of PII or sensitive data. As an additional security best practice, the Lightrun agent files can and should be placed in a path with read-only permissions to further reduce the risk.

Monitoring & Incident Response

Critical infrastructure components and services within Lightrun generate logs and audit trails. Alerts are generated based on severity and addressed by the relevant stakeholder or team within Lightrun.

Physical Security

Access to Lightrun facilities is restricted to authorised staff. Data center security is fully controlled by Amazon, as the providers of Lightrun’s hosting facilities and infrastructure. All data centers include multiple top-tier security controls, such as biometric identification, cameras, vehicle barriers and advanced intrusion detection systems. For more details, see here.