Cyber Security
Enforcement points for an estate whose perimeter now sits at the user, the branch, the workload and the API. Classic firewall, NAC and segmentation work on the ground floor; cloud-delivered edge, protective DNS and encrypted-traffic analytics everywhere else.
What we deliver
Every engagement is scoped to your environment - deploy a single capability or the full stack.
Policy that reflects the applications actually in use rather than a decade of accreted any-any rules.
One policy following the user to any location, replacing hairpinned backhaul to a datacentre they no longer need.
Per-application authorisation that removes the flat, enumerable network a VPN creates.
The first hop of most intrusions - the lookup and the download - blocked before it lands.
Business email compromise cut off at the gateway, the domain and the mailbox rule.
Nothing joins the network unidentified, unhealthy or unsegmented.
Consistent enforcement at sites with no local security staff and no local rack space.
Stay reachable through volumetric, protocol and application-layer floods.
Visibility into the traffic no endpoint agent will ever cover - appliances, medical devices, controllers, unmanaged hosts.
Vendors get precisely the access their contract requires, brokered, recorded and time-bound.
Technical deep dive
Applies to any estate carrying vendor-validated or life-cycle-frozen equipment on a shared network - clinical devices, laboratory instruments, building management, point-of-sale, kiosks, industrial gateways.
What this is
Identity-driven network segmentation. Devices are fingerprinted as they join, placed into a policy group without any change to the device itself, and given exactly the flows their function requires. Vendor access is brokered and recorded rather than granted as a tunnel, and a passive sensor watches the segment because no agent will ever run on these hosts.
The problem being solved
Several hundred devices across multiple sites sit on the same flat network as staff and guest access. Their firmware images are vendor-validated, so patching voids support. Several require inbound access from the manufacturer for diagnostics, currently delivered as a site-to-site tunnel terminating in the core. Nothing can host an endpoint agent. The devices cannot be removed and cannot be secured at the host, so every control has to be imposed by the network around them - while a failed access-control decision has physical consequences, which rules out learning by blocking in production.
Why it is hard
Reference architecture - step through it
device_class: imaging_modality
match: # classification without touching the device
oui: ["00:1B:44", "00:80:E1"]
dhcp_fingerprint: "1,3,6,15,119,252"
observed_services: [104/tcp, 11112/tcp] # imaging protocol
confidence_threshold: 0.92
on_low_confidence: quarantine_observe # never guess
assignment:
method: mac_auth_bypass # device has no supplicant
segment: seg-imaging
mode: monitor # phase 1: log only, 30 days
derived_policy: # generated from 30 days of observed flow
egress:
- to: seg-pacs ports: [104/tcp, 11112/tcp] # image archive
- to: svc-ntp ports: [123/udp]
- to: svc-dns ports: [53/udp]
ingress:
- from: seg-clinical-workstations ports: [11112/tcp]
- from: broker-session ports: [22/tcp, 3389/tcp]
condition: active_brokered_session
default: DENY
exceptions_observed: 0 # 30 days, zero flows outside the set
hard_denies:
- from: seg-guest action: DENY # no path, in any direction
- from: seg-byod action: DENY
- to: internet action: DENY except: [vendor-update.example]Measured change
| Measure | Before | After |
|---|---|---|
| Devices with a known class and owner | unknown - no inventory | 612, continuously profiled |
| Reachability from guest network | full layer-2 adjacency | none, in either direction |
| Vendor access footprint | site-to-site tunnel to core | 1 device, 1 window, recorded |
| Enforcement incidents during rollout | n/a | 0 - 30-day observation before every deny |
The vendor keeps the access its contract requires. A compromised laptop on the guest network can no longer see the device segment at all - and the unpatchable devices stayed unpatched, which was always the immovable constraint.
Schedule a free consultation and our team will connect within 12 hours to understand your environment and map out the right approach.
We respond within 12 hours