Start security left with zero-trust development environments

Talia Moyal Head of Outbound Product at Gitpod

Oct 3, 2024

On October 1, we launched Gitpod Flex, the first automation platform for zero-trust development environments.

TL;DR: zero-trust environments provide

• Isolation of sensitive assets

• Granular identity and access controls

• Advanced encryption

• Full control over networking

• Complete audit logs

The creator of site reliability engineering described SRE as ‘what happens when you ask an engineer to design an operations team.’ Similarly, Gitpod is what happens when you ask a software engineer to design secure development environments – it doesn’t compromise between security and developer experience.

Earlier this week, we introduced Gitpod Flex, the first cloud development environment platform built with zero-trust principles at its core. It can be self-hosted in your cloud, or run locally via Gitpod Desktop. It automates your development workflows, supports Dev Container, and provides a robust security framework for your entire development lifecycle.

This article explains the benefits of zero-trust development environments, and how Gitpod Flex was built to improve security, without compromising developer experience or productivity.

The enterprise benefits of zero-trust development environments

Gitpod is a platform for automated, standardized and secure development environments. Environments come pre-installed with the tools, packages, and access controls a developer needs to code on any project. When it comes to security, admins can centrally manage and automate policies, applying them to all or some environments.

With Gitpod Flex’s runner-based architecture, development environments have zero-trust foundation of ‘never trust, always verify’. This includes features like:

• Granular identity and access: Gitpod doesn’t assume that because an actor is in your network, they are authorized to take action. Every action requires explicit authorization. Actors have caller identities for continuous verification of their access.

• Isolation of sensitive assets: Source code, secrets, and internal network access remain isolated within your network perimeter. This prevents scenarios where compromised developer machines could lead to widespread data breaches.

• Advanced encryption: All data, both at rest and in transit, is encrypted using industry-standard implementations like libsodium. This ensures that even if data is intercepted or exfiltrated, it remains unreadable to unauthorized parties.

• Full control over networking: Gitpod’s architecture is deployed in your infrastructure, providing full control over networking setup.

• Complete audit logs: Every action within the environment is logged, providing a comprehensive audit trail for compliance and security investigations.

• Data sovereignty and compliance: Environments can be deployed across any region or availability zone, helping organizations meet data residency requirements.

Learn more about our architecture in our ‘how we built it’ series or in our docs.

No longer trade-off security and developer experience

Many conversations, especially with regulated verticals like financial services, start like this: ‘Security is our top priority, developer experience will suffer if needed.’ This view sees compromising developer experience as a necessary evil for high security standards. Virtual desktop infrastructure is a prime example – it provides security guarantees but causes significant productivity issues for developers.

Our answer to this is clear: you don’t need to compromise between security and developer experience when using Gitpod cloud development environments.

In addition to the specific features of our zero-trust environments, using Gitpod for development provides general security benefits, without negatively impacting developer productivity.

• Minimize impact of breaches: By isolating sensitive information within zero-trust development environments, the surface area of potential breaches is drastically minimized.

• Control and centralize access: Access controls are automated and managed centrally, ensuring only authorized personnel can use specific resources. This eliminates the need for developers to manage their own access rights, reducing the risk of misconfiguration.

• Reduced risk of human errors: Developers are no longer responsible for security-related updates. Centralized teams can patch development environments and make changes as needed to individual environments, regionally, or globally, ensuring consistent security across all development activities.

• Automated security and compliance:  Gitpod’s development workflow automations can apply security and compliance controls globally. This ensures that policies are consistently enforced without requiring manual intervention from developers.

Gitpod is SOC 2 Type II compliant, adheres to GDPR, and powers some of the world’s largest bank, insurance, and health care providers.

Self-host Gitpod in your cloud account in under 3 minutes

Experience the power of zero-trust development environments for yourself. Try Gitpod for free, self-hosted in your AWS cloud account, in under 3 minutes.