Cloud and security · Access
Zero trust architecture for enterprises
We design and implement zero trust architecture for enterprises: identity-centric access for people and workloads, device posture checks, microsegmentation, privileged access control and continuous verification, delivered in stages that reduce risk early and without stopping the business. Access depends on who and what is asking and on the context, not on where on the network the request comes from, and you own the designs and the code.
Checklist · Cloud and resilience
Cloud migration and resilience checklist for regulated firms
A checklist for regulated firms planning a cloud migration, a resilience programme or a security uplift: workload assessment, landing zone, data residency, resilience, security, delivery, third-party risk and evidence.- 01Eight areas that supervisors and auditors ask about, with testable checks.
- 02Resilience and recovery items that are easy to leave untested.
- 03Third-party, exit and data residency questions for the board.
- 04Seven questions to put to any vendor or engineering partner.
Free download
Get it on screen in a few seconds.
What the system does, module by module.
- 01
Identity foundation
A consolidated directory, single sign-on and strong multi-factor authentication, with lifecycle management that removes access when people move or leave. - 02
Device trust and posture
Registration and health checks for devices, so access decisions consider whether a device is managed, patched and protected. - 03
Policy engine and conditional access
Central policies that decide access from user, device, location, risk and the sensitivity of the resource, with step-up where needed. - 04
Zero trust network access
Access to private applications through identity-aware proxies in place of broad network VPN access, with per-application authorisation. - 05
Microsegmentation
Fine-grained control of traffic between workloads in data centres and clouds, starting with the most critical applications and data. - 06
Workload identity
Cryptographic identities for services and automation, with short-lived credentials and mutual authentication between components. - 07
Privileged access management
Just-in-time elevation, session recording and vaulting for administrator and emergency access, with approval flows. - 08
Data-centric controls
Classification, encryption and rights management that protect data wherever it goes, with access decisions based on the data's sensitivity. - 09
Visibility, analytics and automation
Central telemetry from identity, devices, network and workloads, risk scoring and automated responses such as session revocation.
Reference architecture.
Standards and interfaces
What we design against.
- NIST SP 800-207
- The zero trust architecture publication that defines the model and its components, such as the policy engine and policy enforcement points.
- CISA Zero Trust Maturity Model
- A maturity model across identity, devices, networks, applications and data, used to plan stages.
- Identity standards
- OpenID Connect, SAML, OAuth 2.0, FIDO2 and SCIM for authentication, authorisation and provisioning.
- SPIFFE and SPIRE
- Open standards for workload identity in dynamic environments.
- ISO/IEC 27001 and sector requirements
- Control frameworks and supervisory requirements for access control that zero trust helps to meet.
- IEC 62443 for operational environments
- Zones and conduits that complement zero trust principles in industrial networks.
Data model
The core entities.
- Identity
- User or workload, attributes, roles, authentication methods and lifecycle state.
- Device
- Owner, management state, posture checks, risk and last seen.
- Resource
- Application, data or service, sensitivity, owner and access policy.
- Policy
- Conditions, decision, step-up requirement, version and approval.
- Access decision
- Requester, resource, context, decision, reason and time.
- Privileged session
- User, target, approval, duration and recording.
- Segment and flow rule
- Source and destination workloads, ports, justification and status.
When custom development is the right call.
Controls designed in, not added later.
Strong authentication everywhere
Phishing-resistant multi-factor authentication for privileged and sensitive access, and risk-based step-up elsewhere.Least privilege
Access is granted per application and role, for the time needed, and reviewed regularly.Assume breach
Segmentation and monitoring limit the movement and impact of a compromised account or workload.Resilient policy infrastructure
The policy engine and identity services are highly available, with tested break-glass procedures that are themselves controlled.Privacy-aware telemetry
Signals used for access decisions are collected and retained within privacy rules.
From discovery to a system you run.
- 01
Assessment and target model
We assess identity, devices, networks, applications and data against a maturity model and agree a target and the order of work. - 02
Identity and device foundations
Single sign-on, strong authentication, lifecycle and device management are brought to a solid baseline. - 03
Access to applications
Priority applications move behind identity-aware access with conditional policies, replacing broad network access. - 04
Segment and secure workloads
Microsegmentation and workload identity are applied to the most critical applications and data. - 05
Continuous verification and automation
Telemetry, risk scoring and automated responses are added, and policies are tuned from real decisions.
Relevant work
Where to see our work.
Common questions.
- Is zero trust a product we can buy?
- No. It is an approach built from several controls: identity, device trust, segmentation, privileged access and telemetry. Products provide the components, and the work lies in the design, policy and integration.
- Where should we start?
- With identity: single sign-on, strong authentication and clean lifecycle, because every other control depends on knowing who is asking. Then move the most important applications to identity-aware access.
- Will it get in users' way?
- Done well it is less intrusive than a VPN. Access is decided silently from context, and challenges appear only when risk is higher. We test with users before enforcing.
- How does zero trust apply to legacy and industrial systems?
- Through brokered access, segmentation and monitoring around systems that cannot support modern authentication, rather than changing the systems themselves.
- Who owns the designs and code?
- You do. The designs, the policies and the code stay yours.