The office network is not a password
Every internal application is being put on the open internet, and the VPN is being switched off for good. Nothing will be reachable because of where the request came from — sitting on the office wire is to grant exactly as much as sitting in a hotel lobby, which is nothing.
The web gateway and the SSH gateway are drawn. What decides, and what they decide from, is not.
- R1An application may be reached only by the right person on a company-issued machine. Knowing the person is not enough: the same credentials typed on an unmanaged laptop must fail, so something must prove which machine is asking, and that proof must not be copyable onto another machine.
- R2A device that stops reporting its state must lose access on its own, without anyone filing a ticket or running a cleanup. Trust is something a device keeps renewing, not something it is granted once.
- R3Web access and shell access must be governed by the same decision, made in one place. Two decision points mean two answers to the same question and a rule tightened in one of them staying loose in the other.
Outside every boundary: Web gateway, An employee (anywhere at all), SSH gateway, Identity provider (proves the person), Device inventory (what each machine reports), an empty slot for the proves which machine, not who, tier 1, an empty slot for the a level that lapses if reports stop, tier 1, an empty slot for the the one thing that says yes or no, tier 2 Connections: An employee calls Web gateway An employee calls Identity provider proves which machine, not who controls a level that lapses if reports stop Device inventory calls a level that lapses if reports stop — current state a level that lapses if reports stop calls the one thing that says yes or no Web gateway calls the one thing that says yes or no — may this pass SSH gateway calls the one thing that says yes or no Identity provider calls the one thing that says yes or no