Information Security & Firewall for companies in São Leopoldo - RS

Different environments, different policies

The way out is not to have one policy, but four — one per environment type, each with its own rules and no path between them except what is explicitly necessary.

The administrative segment is the most restrictive: management systems, financial data, personal data, with role-based access and logging. The development and research segment is permissive inside and contained outside — freedom to install, test, and stand up services, with no reach into the administrative side. The lab segment hosts equipment that rarely gets updated and depends on isolation. And the segment for guests, students, or personal devices is separate from everything, with internet access and nothing more.

Defined that way, the four coexist without competing. Research loses its reason to work around the policy, because the policy no longer gets in its way — and the administrative side stops depending on the good behavior of an experimental environment.

Personal devices are an expected case, not an exception

In an environment with high turnover and a technical culture, people bring their own equipment. Treating that as a violation to be stamped out does not work; treating it as an expected case does.

The design that solves it is a segment for personal devices with access to the internet and to the published services the person needs to use, with no reach into the internal network. The legitimate need is met through a controlled path instead of through an improvisation nobody can see.

Access lifecycle: the same old problem

The other side of high turnover is leftover access. The intern who left, the grant holder whose project ended, the fixed-term contractor, the visiting researcher — each of them received credentials and, in most environments, none of them lost them.

The answer is individual credentials per person, permissions assigned by role rather than copied from someone similar, a second factor wherever possible, and expiry dates on engagements with a known end. Access that expires and gets renewed if still needed inverts the error pattern.

And periodic review is worth having: a recurring check that answers whether there is still an active credential belonging to someone who should not have one. In any initial survey, that list exists and it surprises people.

Published services demand their own care

Technology and research environments publish things: a system reachable from outside, a portal, a test environment someone left available for a partner to look at.

Every publication is a door, and the risk is not in publishing — it is in publishing and forgetting. An exposed test environment tends to have a weak password, an outdated version, and real data copied from the production system "just for testing."

The treatment is to inventory what is published, require authentication on everything that is not intentionally public, and periodically review whether each publication still has a purpose. Expiry dates apply here too.

SD-WAN and distributed sites

The profile on record for the city includes distributed sites and mixed networks. When systems and services run at one address or in the cloud and are used from another, the link becomes part of the application.

The secondary path does not need to replicate the primary — it sustains the essentials: the management system, authentication, telephony, and whatever the operation cannot lose. And it is worth more if it runs on a different technology, because then it fails for different reasons.

With two paths, SD-WAN chooses continuously by measuring latency, loss, and jitter, and switches when one degrades. Prioritization matters in a research environment: a large transfer of experimental data should not compete on equal terms with authentication and telephony — it can tolerate minutes of delay, they cannot.

The sectors that drive demand in São Leopoldo

Services, industry, technology, and education make up the city's profile. Technology and education concentrate the separation of environments described above and the access lifecycle. Industry brings equipment that does not get updated, handled through isolation. Services firms weigh heaviest on confidentiality and access logging.

How we run the deployment

It starts with the survey: links, edge equipment, inherited rules, active remote access, published services, existing credentials, and the actual traffic. The inventory of access and of published services is the most revealing part.

Then comes the design — segments per environment type, a policy per segment, an individual credential structure organized by role with expiry, and classification of the critical traffic.

Activation is scheduled, because an intervention at the edge interrupts the connection for a few minutes. Afterwards, the rules are tuned against observed traffic, and two recurring routines take effect: the access review and the review of what is published.