Cloud security

Deploy cloud security.
Make change repeatable.

Quokka used Infrastructure as Code to deploy Fire Rescue Victoria’s cloud security environment, complete the migration and integrate it with the wider network through Telstra Cloud Connect.

Fire Rescue Victoria

The constraint

The cloud move brought deployment, security and network integration together. The environment needed a repeatable way to build and change infrastructure, while working with the network and services already in use.

Our work

We took cloud security from design into deployment and migration. Infrastructure as Code defined the deployment; Telstra Cloud Connect joined the cloud environment to the wider network. Central management, logging and identity requirements formed part of the engineering.

Repeatable deployment, connected to the wider network.

DEPLOYMENT

Infrastructure as CodeInfrastructure defined in code

Repeatable deploymentUse the same defined process for builds and changes

Cloud security environmentDeploy the design into Azure

CONNECTIVITY

Wider networkExisting environments and services

Telstra Cloud ConnectIntegration with the wider network

Azure environmentConnected cloud workloads and security

DELIVEREDSuccessful migration into the environment

A repeatable deployment method and a connected cloud security foundation.

The top row shows the deployment process. The lower row shows connectivity; Infrastructure as Code is separate from the application traffic path.

From design to a working environment

Make deployment repeatable

Define the infrastructure in code and use that code to deploy it. The deployment process can be repeated and maintained as the environment changes.

Connect cloud and existing services

Use Telstra Cloud Connect to integrate the cloud environment with the wider network. Coordinate connectivity, routing and security dependencies with the migration.

Complete the move

Carry the design through implementation and a successful migration, working with the wider programme to bring the environment into use.

The result

FRV successfully migrated into the cloud security environment. Infrastructure as Code provided a repeatable deployment method, and Telstra Cloud Connect integrated the environment with the wider network.

Central configuration and logging design

Identity integration across on-premises and Azure

Deployment sequence and service dependencies documented

Delivered in conjunction with Deloitte and Data#3.

Inside the delivery

How the engineering supports operation.

Repeatable deployment, network integration and central management each support a different part of operating the environment.

Make the deployment process repeatable

We deployed using Infrastructure as Code. Defining infrastructure in code gives the team a consistent basis for recreating and changing the environment, instead of relying on a sequence of manual configuration steps.

Join the cloud environment to the wider network

Telstra Cloud Connect provided the integration with the wider network. The engineering brought connectivity and routing dependencies into the deployment and migration, alongside the security controls.

Keep management and traffic paths distinct

The management design uses Panorama for configuration and logging across on-premises and Azure firewalls. Application traffic passes through the firewalls; Panorama manages their controls. Separating those roles keeps the connectivity and management design clear.

Account for identity and shared sessions

The identity design covers directory integration, User-ID mappings and Terminal Services agents for shared hosts. It records the service dependencies and permissions needed to associate traffic with the right user across the hybrid environment.

Management and identity relationships

Management and identity support the firewalls

Management relationship

PanoramaPolicy and configuration management

On-premises & Azure firewallsReceive the managed configuration

Identity relationship

Directory / User-IDIdentity and shared-session information

On-premises & Azure firewallsApply policy using the available identity context

These are management and identity relationships. Application traffic is not shown passing through Panorama or the directory.

What needs to work better?

Talk to us about the environment, the constraint and the change.

Talk to Quokka

Deploy cloud security.Make change repeatable.