The challenge
The insurance group ran a flat, shared network across its parent and affiliated companies, so an outage or breach at one could reach the others, and more than once a headquarters outage knocked a sister company’s users offline. The core was aging, configurations had drifted, remote access lacked modern MFA, and personal mobile devices could land on the internal network. The group needed to audit and stabilize the network, then lock it down with identity-driven Zero Trust, without disrupting day-to-day insurance operations.
Our approach
- Audit and remediate: documented traffic patterns across the company-wide and cloud network, fixed packet loss and routing loops, stabilized and standardized configurations, and migrated the aging core to Cisco 9000 at both primary data centers.
- Ring-fence the network: deployed Cisco Firepower 4100 next-generation IPS to carve the network into zones with full traffic visibility and zone-based policy governing exactly what may pass between them.
- Identity-driven micro-segmentation: deployed and tuned Cisco ISE so devices are profiled and dynamically assigned to the right zone and VLAN with a matching policy; only corporate devices reach the internal network, while personal phones are steered to a guest SSID with internet-only access.
- Automated threat response: integrated Cisco Firepower with ISE over pxGrid so a compromised endpoint is quarantined automatically at the switch port, and integrated Aruba wireless with ISE.
- Modern remote access: migrated VPN to Cisco AnyConnect with ISE and Microsoft Azure MFA.
- Isolate a subsidiary: segmented an affiliated company off the shared network so an event elsewhere in the group no longer reaches it.
The solution
VeeMost took the group from a flat, drifting, shared network to a layered, identity-driven Zero Trust posture. First we audited and stabilized the network and modernized the core; then we ring-fenced it with Cisco Firepower and enforced identity-based micro-segmentation with Cisco ISE, so every device is profiled and placed in the right zone, only corporate devices are admitted, compromised endpoints are quarantined automatically, and remote access is protected by Azure MFA. A problem at one company in the group can no longer spread to the others, and the security team runs it all from consistent, central policy.
