Network security

When we help

• A flat networkEverything reaches everything, and a problem in one place can spread everywhere.
• Rules nobody understandsThe firewall grew rule by rule, and nobody knows anymore why they all exist.
• Traceability requirementsAccess control and traceable changes for customers, auditors and applicable security requirements, including NIS2.
• Security separate from operationsHardening and logging became a project of their own instead of part of daily work.

Every flow with a purpose and an owner

The network is divided by what needs protecting and who needs to reach it, whichever firewalls and switches you run. Every rule between the parts has a purpose you can read and an owner who answers for it.

• Divided by what needs protectingSegmentation Divided by what needs protecting Users, guests, servers, management and the systems that run operations get their own segments, with only the flows the business needs between them, described in a segment plan.
• Who and what may connectAccess control Who and what may connect Which users and devices reach which segments, for example with 802.1X, and who may administer the network, only from a separate management network.
• Rules you can reviewFirewall rules Rules you can review Rules live as code in Git and change through review. You can see why a rule exists, who owns it and when it changed, and rules the traffic no longer needs are removed.

Hardening and logging in daily operations

Security holds when it's part of how the network is run and changed every day.

• Hardening by defaultThe same baseline settings on every device, defined in templates, so a new device isn't an exception.
• Logging you can useLogins, changes and denied flows are collected in one place, such as your SIEM, and stored off the devices.
• Reviewed changesNew rules and changed segments are reviewed, with a history of who changed what and why.

Segmentation in stages

An existing network is divided up while the business keeps running. New rules log first, so you can see what they would block before they take effect.

• Flow discoveryWhat runs on the network today What the business needs Rules with no known purpose Result Who needs to reach what, and why
• Segments and rulesSegments by what needs protecting Rules with a purpose and an owner Management on its own network Result A segment plan and a rule set as code
• Log before blockingNew rules log first Unexpected flows are investigated One segment at a time Result Rules tested against real traffic
• Enforce and maintainThe rules take effect Changes through review Rules are reviewed regularly Result A network where only the documented flows get through

Rules and segments you can manage

The segment plan, rule set and logging are yours, with the reasons behind every rule. We walk through them together before we leave.

• Add a rule through review
• Trace a denied flow in the logs
• Review the rules for a segment
• Segment planThe segments, what they protect and the flows between them.
• Rule set as codeEvery rule with its purpose, owner and history.
• Logging and alertsWhere the logs are, how long they're kept and what triggers an alert.
• RunbooksAdding a rule, adding a segment and investigating a denied flow.

Related services