Hubble: Our Tool for Encapsulating and Extending Security Tools

Summary

Shopify’s Trust team faced rising complexity in securing a distributed device fleet, including many tools, provisioning and patching work, varied networks, and the loss of in-person remediation. Hubble was built as a unified layer over mobile device management and other security systems, ingesting and standardizing their data while sending commands back with granular access controls and centralized auditing. IT staff use it for inventory, device management, and security, while employees can view device health and compliance, receive remediation guidance, and manage test-device or beta participation. The platform also serves as a standardized source for automation, and the post presents encapsulation and cross-team investment as ways to reduce administrative overhead, support proactive security, and limit risk.

Context

Shopify’s distributed, Digital by Design work model made device security more difficult because network environments became more varied and in-person patching or remediation was no longer available. The Trust team also faced the growing cost, training burden, access-management complexity, and risk associated with maintaining many security tools.

Approach / What changed

Hubble encapsulates and extends mobile device management and other security tools behind one interface. It ingests and standardizes data, sends commands to integrated systems, applies granular access levels, centralizes access auditing, exposes device health and compliance information to employees, and provides actionable remediation guidance. Hubble also acts as a standardized data source for automation and security processes.

Takeaways

• Hubble centralizes inventory, device management, security data, access controls, and auditing instead of giving employees direct access to many separate administration panels.
• Employees can review defined device metrics such as OS and patch compliance and VPN usage, receive notifications, follow remediation guidance, and opt into test-device or beta programs.
• A standardized source of reliable data lets other teams build automations without separately normalizing data or integrating with many individual services.

Related reading