Security starts at home: How we secure LastPass

Web filtering

We use tools to block risky web categories across all corporate devices, ensuring consistent protection against malware and data loss no matter where our teams work.

Endpoint protection

We use multiple EDR solutions to monitor work devices 24/7, enabling rapid threat detection and containment through managed detection and response. Additionally, we deny access to corporate systems from personal devices.

Device encryption

All corporate devices are encrypted using BitLocker or FileVault, ensuring the protection of data in our devices.

System hardening

We use CIS best-practice benchmarks for the hardening of our corporate devices, MDM software to enforce security policies, and vulnerability management software to detect and address common vulnerabilities and exposures (CVEs).

Vulnerability treatment & patching

Our patching cycles prioritize high-risk applications, guided by analytics and threat intelligence to ensure targeted, effective remediation.

Privileged access management

Every elevation requires a documented business justification and is continuously monitored by compensating controls to detect and respond to any abnormal behavior.

Conditional access & OS authentication

We block logins from high-risk regions and unauthorized devices, enforcing phishing-resistant MFA via the use of hardware tokens across platforms.

Network access protection

We make use of a leading SASE solution with micro-segmentation and role-based access to backend, strengthened by conditional access policies which validate security posture before access is allowed.

Role-based micro-segmentation

Access to backend systems is tightly segmented by user role, ensuring employees only reach the environments and data necessary for their responsibilities.

Want to see our security? Find the latest GRC updates here.