Cloud, Kubernetes and Infrastructure Security
Hybrid Infrastructure Security Architecture
We assess the connections between your on-premises systems and the cloud as a whole. We identify the paths that allow a breach in one environment to reach the other.
What it is
In hybrid setups, the on-premises network and the cloud are connected at multiple points. Identity sync, private network links and management agents are the main connections. These links create a single attack surface across both environments. The assessment reviews them together and maps the paths in both directions.
Scope
- Identity sync servers and authentication method
- Private links such as VPN, ExpressRoute or Direct Connect, and the access passing through them
- Management agents that can run commands on on-premises servers from the cloud
- Administrator accounts and admin workstations that manage both environments
- Backup, monitoring and deployment tools with privileges spanning both environments
The need
When organizations need it
- When a new private line or VPN connection is added between the on-premises network and the cloud.
- When it is clear the cloud migration will be lengthy and both environments will operate side by side for years.
- When management agents are deployed to manage on-premises servers from the cloud.
Method
How we work
-
Link inventory
We list each identity, network and management link between the two environments.
-
Critical tier
We place servers and accounts whose compromise would affect both environments in the most critical admin tier.
-
Crossing paths
We map the paths from on-premises to the cloud and from the cloud to on-premises.
-
Target architecture
We propose a target architecture that separates admin tiers and narrows the links.
Outcome
What you have at the end
You know the risk and owner of every link between the two environments. You have a target architecture that limits how a breach in one can reach the other.
Frequently asked questions
How is this different from the hybrid identity and federation review?
The hybrid identity review focuses on sync and federation trust. This assessment also covers network links, management agents and tools operating in both environments.
Why is the identity sync server so critical?
This server operates with high privilege between two directories. Microsoft also requires it to be protected in the most critical tier (Tier 0), alongside domain controllers.
Cloud, Kubernetes and Infrastructure Security
Other services in this area
Let's talk about this service.
Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.
Schedule a Meeting