Architecture

How we actually build it.

The real problems behind the work, written up in full. Cutting an agency off a legacy VPN with no downtime window, adding MFA to an app that has no idea what one is, running a capable model inside the boundary when the data can't leave it. No slideware, just the architecture and the trade-offs.

01

Managed Network Edge

01 When the VPN is the way in: retiring appliance-based remote access Cutting over from always-on VPN to identity-aware access without a downtime window. Draft 02 Putting modern auth in front of an app that has none Putting a modern auth boundary in front of an app that was never designed for one. Draft 03 Egress rules that would have caught Salt Typhoon A secure internet gateway on Azure Firewall, with rule policy that maps to the ISM. Draft
02

Managed SIEM

01 The Sentinel bill nobody scoped for, and how to cap it Getting the right logs into Sentinel without an unbounded Log Analytics bill. Draft 02 Tuning out the noise: alerting a small team can live with Analytics rules tuned to fire on what matters, not on everything. Draft 03 A triage workflow a two-person SOC can actually run An alert-to-action workflow a two-person team can actually run. Draft
03

Azure Landing Zone

01 An assessable tenant in two weeks, not two quarters The opinionated foundation that gets an agency to an assessable baseline fast. Draft 02 Containing the blast radius: hub-spoke as damage control Network topology that isolates workloads while keeping shared services central. Draft 03 Ten ISM controls you can diff, not just document Turning control text into enforceable, auditable policy-as-code. Draft
04

Essential 8 Readiness

01 Every E8 control, mapped to a config you can deploy Every Essential 8 control tied to a deployable, checkable Azure setting. Draft 02 Meeting the 48-hour patch rule without living in the console Automating the patch-currency controls that assessors always test first. Draft 03 Why E8 assurance rarely stays automated for long Two controls automate cleanly, one conditionally, and the rest need a person. Where the line sits, with the queries to prove it. Published
05

Hardened Identity Management

01 No standing admin, nothing to steal Removing always-on admin rights without breaking day-to-day operations. Draft 02 Blocking device-code phishing without breaking the old apps Enforcing modern access controls around apps that predate them. Draft 03 Access sprawl is the thing that gets reset against you Recertifying privileged access on a schedule assessors will accept. Draft
06

Application Modernisation

01 Sign in as anyone: why we move apps off hand-rolled SAML Re-homing identity for an app that only speaks SAML, with no user-visible break. Draft 02 A second factor for an app that has never heard of one Adding a second factor to an app that has no idea what one is. Draft 03 AI on a legacy codebase: real speed, real footguns Where AI-assisted refactoring helps, and where it quietly makes things worse. Draft
07

AI Infrastructure

01 When the model can't leave the boundary Running a capable model inside the boundary when the data can't leave it. Draft 02 Local when it must be, cloud when it can be Keeping sensitive inference local while reaching for the cloud when it's safe. Draft 03 Connecting agency data to AI without opening an exfil path Wiring data to a model through an abstraction you can swap out later. Draft
08

Cross-Silo Connectivity

01 The boundary that fails is usually the identity one Establishing trust across a boundary where neither side owns the other. Draft 02 Moving data across a boundary, and proving you did it safely Moving data across a boundary with evidence an assessor will accept. Draft 03 SSH trust across silos, after the year of OpenSSH bugs The plumbing that lets scripts, SSH, and certificates cross the boundary safely. Draft