Critical Infrastructure · 2020 – present
Zero Trust and Micro-Segmentation for Critical Infrastructure
Leading Zero Trust Architecture and micro-segmentation programmes at a critical-infrastructure utility, alongside NAC, identity, endpoint privilege management and secure remote access.
The Challenge
A utility that keeps a city’s power and water running can’t afford to assume that anything inside its network is safe. Its estate covers traditional infrastructure, cloud, digital platforms and, increasingly, AI systems. It also has to meet strict regional standards such as DESC ISR alongside ISO 27001, NIST and the CIS Controls. A flat network with perimeter-only defences is the wrong answer for that kind of environment.
What I Am Doing
I lead the Zero Trust Architecture and micro-segmentation programmes, and I was part of the core team that designed the NAC, micro-segmentation and Zero Trust strategies. In practice, that means making identity, device posture and segmentation the basis for every access decision, rather than network location.
The programme is delivered through a set of connected controls:
- Secure remote access: planned, designed and implemented the remote access strategies.
- Identity and privilege: identity and access management, and endpoint privilege management designed and integrated into the estate.
- Visibility for a critical landscape: designed and implemented network packet broker and WAF integrations.
- Integrity of critical assets: file integrity monitoring implemented with service owners, the SOC and FIM administrators.
- Mobile: mobile device management for the enterprise mobile ecosystem.
- Assurance: security architecture reviews, threat modelling, risk assessments and compliance gap analyses against ISO 27001, NIST, CIS Controls, DESC ISR and internal standards.
Alongside this, I work with compliance teams to keep the regulatory framework controls in place as the architecture changes.
Why It Matters
Zero Trust only works when it’s a programme rather than a product: architecture, identity, segmentation, monitoring and compliance all have to move together. That’s the work I lead, in an environment where a security failure can affect essential public services. It’s also the foundation I now extend to AI systems.