Enterprise Zero Trust Architecture with Cloudflare Access#

1
VPN Limitations:
2
  - Implicit Trust: Once connected, users access entire network
3
  - Poor Performance: Backhauling traffic causes latency
4
  - Complex Management: Certificate distribution, client updates
5
  - Security Gaps: No granular access control
6
  - Scalability Issues: VPN concentrators become bottlenecks
7
  - User Experience: Connection drops, slow speeds

1
// Initial configuration checklist
2
const setupSteps = {
3
  1: "Set team name (one.dash.cloudflare.com)",
4
  2: "Configure authentication methods",
5
  3: "Set up device enrollment",
6
  4: "Create initial access policies",
7
  5: "Install cloudflared for tunnels",
8
  6: "Deploy WARP client to test users"
9
};

1
// Okta SAML Configuration
2
const oktaConfig = {
3
  // In Okta Admin Console
4
  singleSignOnURL: "https://yourteam.cloudflareaccess.com/cdn-cgi/access/callback",
5
  audienceURI: "https://yourteam.cloudflareaccess.com",
6
  nameIDFormat: "EmailAddress",
7

8
  // Attribute Statements
9
  attributes: {
10
    email: "user.email",
11
    name: "user.displayName",
12
    groups: "user.groups",
13
    department: "user.department"
14
  }
15
};
16

17
// In Cloudflare Dashboard
18
const cloudflareOktaSetup = {
19
  type: "SAML",
20
  name: "Okta",
21
  idpEntityId: "http://www.okta.com/YOUR_IDP_ID",
22
  ssoEndpoint: "https://yourcompany.okta.com/app/app_id/sso/saml",
23
  signingCertificate: "PASTE_X509_CERTIFICATE",
24

25
  // Optional attributes for policy decisions
26
  attributeMapping: {
27
    email: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress",
28
    groups: "http://schemas.xmlsoap.org/claims/Group"
29
  }
30
};

1
// Google Workspace OIDC Configuration
2
const googleConfig = {
3
  clientId: "YOUR_CLIENT_ID.apps.googleusercontent.com",
4
  clientSecret: "YOUR_CLIENT_SECRET",
5
  authUrl: "https://accounts.google.com/o/oauth2/v2/auth",
6
  tokenUrl: "https://oauth2.googleapis.com/token",
7
  scope: "openid email profile",
8

9
  // In Cloudflare
10
  redirectUrl: "https://yourteam.cloudflareaccess.com/cdn-cgi/access/callback"
11
};

1
// Device posture checks
2
const devicePolicies = [
3
  {
4
    name: "Require OS Updates",
5
    type: "os_version",
6
    config: {
7
      windows: { minVersion: "10.0.19043" },
8
      macos: { minVersion: "14.0" },
9
      linux: { kernel: "5.15+" }
10
    }
11
  },
12
  {
13
    name: "Require Disk Encryption",
14
    type: "disk_encryption",
15
    config: {
16
      requireEncryption: true,
17
      allowedTypes: ["BitLocker", "FileVault", "LUKS"]
18
    }
19
  },
20
  {
21
    name: "Require Antivirus",
22
    type: "client_certificate",
23
    config: {
24
      windows: ["Windows Defender", "CrowdStrike"],
25
      macos: ["XProtect", "CrowdStrike"]
26
    }
27
  },
28
  {
29
    name: "Block Jailbroken Devices",
30
    type: "jailbroken",
31
    config: { block: true }
32
  },
33
  {
34
    name: "Require Corporate Certificate",
35
    type: "client_certificate",
36
    config: {
37
      certificateCN: "*.corp.yourcompany.com",
38
      requireValid: true
39
    }
40
  }
41
];

1
# Device inventory integration
2
import requests
3
import csv
4

5
def verify_corporate_devices():
6
    """Verify devices against corporate inventory"""
7

8
    # Export from MDM/Asset Management
9
    corporate_devices = []
10
    with open('corporate_devices.csv', 'r') as f:
11
        reader = csv.DictReader(f)
12
        for row in reader:
13
            corporate_devices.append({
14
                'serial': row['serial_number'],
15
                'user': row['assigned_user'],
16
                'type': row['device_type']
17
            })
18

19
    # Upload to Cloudflare
20
    headers = {
21
        'Authorization': f'Bearer {CF_API_TOKEN}',
22
        'Content-Type': 'application/json'
23
    }
24

25
    for device in corporate_devices:
26
        payload = {
27
            'serial_number': device['serial'],
28
            'user_email': device['user'],
29
            'notes': f"Corporate {device['type']}"
30
        }
31

32
        response = requests.post(
33
            f'https://api.cloudflare.com/client/v4/accounts/{ACCOUNT_ID}/devices/policy/serial_numbers',
34
            headers=headers,
35
            json=payload
36
        )
37

38
        print(f"Added device {device['serial']}: {response.status_code}")
39

40
verify_corporate_devices()

1
// Granular access policies
2
const accessPolicies = [
3
  {
4
    name: "Engineering Team - Full Access",
5
    app: "jenkins.yourcompany.com",
6
    decision: "allow",
7
    include: [
8
      { email: { domain: "yourcompany.com" } },
9
      { groups: ["Engineering", "DevOps"] }
10
    ],
11
    require: [
12
      { devicePosture: ["Require OS Updates", "Require Disk Encryption"] }
13
    ],
14
    exclude: [
15
      { email: ["contractor@external.com"] }
16
    ]
17
  },
18
  {
19
    name: "Finance Team - Limited Access",
20
    app: "dashboard.yourcompany.com",
21
    decision: "allow",
22
    include: [
23
      { groups: ["Finance"] }
24
    ],
25
    require: [
26
      { geo: { country: ["US", "UK"] } },
27
      { devicePosture: ["Corporate Device"] }
28
    ],
29
    sessionDuration: "8h"
30
  },
31
  {
32
    name: "Contractors - Restricted Access",
33
    app: "docs.yourcompany.com",
34
    decision: "allow",
35
    include: [
36
      { email: { domain: "contractors.yourcompany.com" } }
37
    ],
38
    require: [
39
      { mfa: true },
40
      { accessGroups: ["Approved Contractors"] }
41
    ],
42
    sessionDuration: "1h",
43
    purposeJustification: {
44
      required: true,
45
      prompt: "Please provide reason for access"
46
    }
47
  },
48
  {
49
    name: "Emergency Break-Glass",
50
    app: "*.yourcompany.com",
51
    decision: "allow",
52
    include: [
53
      { email: ["security@yourcompany.com", "ciso@yourcompany.com"] }
54
    ],
55
    require: [
56
      { mfa: true },
57
      { approval: {
58
          approvers: ["manager@yourcompany.com"],
59
          timeout: "5m"
60
        }
61
      }
62
    ],
63
    sessionDuration: "30m"
64
  }
65
];

1
# Generate service tokens for API access
2
import requests
3
import json
4

5
def create_service_token(name, duration_years=1):
6
    """Create service token for automated access"""
7

8
    headers = {
9
        'Authorization': f'Bearer {CF_API_TOKEN}',
10
        'Content-Type': 'application/json'
11
    }
12

13
    # Create service token
14
    payload = {
15
        'name': name,
16
        'duration': f'{duration_years}y'
17
    }
18

19
    response = requests.post(
20
        f'https://api.cloudflare.com/client/v4/accounts/{ACCOUNT_ID}/access/service_tokens',
21
        headers=headers,
22
        json=payload
23
    )
24

25
    token_data = response.json()['result']
26

27
    # Save credentials securely
28
    credentials = {
29
        'client_id': token_data['client_id'],
30
        'client_secret': token_data['client_secret'],
31
        'expires_at': token_data['expires_at']
32
    }
33

34
    # Store in HashiCorp Vault or AWS Secrets Manager
35
    store_in_vault(f'cloudflare/service-tokens/{name}', credentials)
36

37
    return credentials
38

39
# Use service token for API access
40
def api_request_with_service_token(url, client_id, client_secret):
41
    """Make authenticated API request"""
42

43
    headers = {
44
        'CF-Access-Client-Id': client_id,
45
        'CF-Access-Client-Secret': client_secret
46
    }
47

48
    response = requests.get(url, headers=headers)
49
    return response.json()

1
// DNS security policies
2
const dnsPolicies = [
3
  {
4
    name: "Block Malware Domains",
5
    action: "block",
6
    filters: ["security_threats"],
7
    schedule: "always"
8
  },
9
  {
10
    name: "Block Adult Content",
11
    action: "block",
12
    categories: ["adult_themes", "gambling"],
13
    schedule: "business_hours",
14
    groups: ["All Employees"]
15
  },
16
  {
17
    name: "Block Newly Registered Domains",
18
    action: "block",
19
    filters: ["newly_seen_domains"],
20
    age: 30, // Block domains < 30 days old
21
    allowlist: ["legitimate-new-site.com"]
22
  },
23
  {
24
    name: "Block Cryptocurrency Mining",
25
    action: "block",
26
    categories: ["cryptocurrency", "mining"],
27
    groups: ["All Employees"],
28
    exceptions: ["Finance Team"]
29
  },
30
  {
31
    name: "Isolate Suspicious Sites",
32
    action: "isolate",
33
    riskScore: "high",
34
    categories: ["questionable"],
35
    groups: ["All Employees"]
36
  }
37
];
38

39
// Custom block lists
40
const customBlockLists = [
41
  {
42
    name: "Competitor Sites",
43
    domains: [
44
      "competitor1.com",
45
      "competitor2.com"
46
    ],
47
    action: "block",
48
    message: "Access to competitor sites is restricted"
49
  },
50
  {
51
    name: "Time Wasting Sites",
52
    domains: [
53
      "reddit.com",
54
      "twitter.com",
55
      "facebook.com"
56
    ],
57
    action: "allow",
58
    timeRestriction: {
59
      allowedHours: ["12:00-13:00"], // Lunch hour only
60
      timezone: "America/New_York"
61
    }
62
  }
63
];

1
// HTTP/HTTPS inspection rules
2
const httpPolicies = [
3
  {
4
    name: "Block File Uploads to Personal Storage",
5
    action: "block",
6
    method: "POST",
7
    hosts: ["dropbox.com", "drive.google.com", "onedrive.live.com"],
8
    groups: ["All Employees"],
9
    exceptions: ["Marketing Team"]
10
  },
11
  {
12
    name: "Scan Downloads for Malware",
13
    action: "scan",
14
    fileTypes: [".exe", ".msi", ".dmg", ".deb", ".rpm"],
15
    maxSize: "100MB",
16
    scanners: ["clamav", "virustotal"]
17
  },
18
  {
19
    name: "Block Unauthorized API Access",
20
    action: "block",
21
    hosts: ["api.openai.com", "api.anthropic.com"],
22
    exceptions: ["Engineering Team"],
23
    log: true
24
  },
25
  {
26
    name: "Inspect TLS Traffic",
27
    action: "decrypt",
28
    categories: ["all"],
29
    exceptions: [
30
      "banking",
31
      "health",
32
      "government"
33
    ],
34
    certificatePinning: "allow_bypass"
35
  }
36
];

1
# DLP Profile Configuration
2
dlp_profiles = [
3
    {
4
        "name": "Credit Card Protection",
5
        "entries": [
6
            {
7
                "name": "Visa/Mastercard",
8
                "pattern": r"\b(?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14})\b",
9
                "enabled": True
10
            },
11
            {
12
                "name": "American Express",
13
                "pattern": r"\b3[47][0-9]{13}\b",
14
                "enabled": True
15
            }
16
        ],
17
        "action": "block",
18
        "alerting": True
19
    },
20
    {
21
        "name": "SSN Protection",
22
        "entries": [
23
            {
24
                "name": "US Social Security",
25
                "pattern": r"\b\d{3}-\d{2}-\d{4}\b",
26
                "enabled": True
27
            }
28
        ],
29
        "action": "block",
30
        "alerting": True
31
    },
32
    {
33
        "name": "Source Code Protection",
34
        "entries": [
35
            {
36
                "name": "API Keys",
37
                "pattern": r"(?i)(api[_-]?key|apikey|api[_-]?secret)[\s]*[:=][\s]*['\"]?([a-zA-Z0-9]{32,})['\"]?",
38
                "enabled": True
39
            },
40
            {
41
                "name": "Private Keys",
42
                "pattern": r"-----BEGIN (RSA |EC )?PRIVATE KEY-----",
43
                "enabled": True
44
            }
45
        ],
46
        "action": "block",
47
        "alerting": True
48
    }
49
]
50

51
# Apply DLP policies
52
def configure_dlp():
53
    for profile in dlp_profiles:
54
        response = requests.post(
55
            f"https://api.cloudflare.com/client/v4/accounts/{ACCOUNT_ID}/gateway/dlp/profiles",
56
            headers=headers,
57
            json=profile
58
        )
59
        print(f"Created DLP profile: {profile['name']}")

1
// Browser isolation policies
2
const isolationPolicies = [
3
  {
4
    name: "Isolate Uncategorized Sites",
5
    trigger: "uncategorized",
6
    action: "isolate",
7
    settings: {
8
      disableClipboard: false,
9
      disablePrinting: true,
10
      disableDownload: false,
11
      disableUpload: true
12
    }
13
  },
14
  {
15
    name: "Isolate High-Risk Sites",
16
    trigger: "riskScore",
17
    threshold: "medium",
18
    action: "isolate",
19
    settings: {
20
      disableClipboard: true,
21
      disablePrinting: true,
22
      disableDownload: true,
23
      disableUpload: true,
24
      disableKeyboard: false
25
    }
26
  },
27
  {
28
    name: "Isolate External Links",
29
    trigger: "external",
30
    domains: ["!*.yourcompany.com", "!*.trusted-partner.com"],
31
    action: "isolate",
32
    groups: ["Finance", "HR"],
33
    settings: {
34
      disableClipboard: true,
35
      watermark: "CONFIDENTIAL - {{user.email}}"
36
    }
37
  }
38
];

1
# Configure document isolation
2
def setup_document_isolation():
3
    """Configure isolation for document viewing"""
4

5
    policies = [
6
        {
7
            "name": "Isolate PDF Viewing",
8
            "fileTypes": [".pdf"],
9
            "action": "isolate",
10
            "settings": {
11
                "disableDownload": True,
12
                "disablePrint": True,
13
                "watermark": {
14
                    "enabled": True,
15
                    "text": "{{user.email}} - {{datetime}}"
16
                }
17
            }
18
        },
19
        {
20
            "name": "Isolate Office Documents",
21
            "fileTypes": [".docx", ".xlsx", ".pptx"],
22
            "action": "isolate",
23
            "settings": {
24
                "disableDownload": False,
25
                "disablePrint": False,
26
                "requireJustification": True
27
            }
28
        }
29
    ]
30

31
    for policy in policies:
32
        configure_isolation_policy(policy)

1
// Shadow IT discovery
2
const casbDiscovery = {
3
  enabled: true,
4
  scanMethods: ["dns", "http", "tls"],
5
  reporting: {
6
    frequency: "weekly",
7
    recipients: ["security@yourcompany.com"],
8
    includeRiskScores: true
9
  },
10
  autoBlock: {
11
    enabled: true,
12
    riskThreshold: "critical",
13
    categories: ["malware", "phishing"]
14
  }
15
};

1
# CASB API integrations
2
def configure_saas_security():
3
    """Configure CASB for SaaS applications"""
4

5
    integrations = [
6
        {
7
            "name": "Microsoft 365",
8
            "type": "api",
9
            "tenant_id": "your-tenant-id",
10
            "checks": [
11
                "mfa_enforcement",
12
                "external_sharing",
13
                "admin_accounts",
14
                "data_residency"
15
            ]
16
        },
17
        {
18
            "name": "Google Workspace",
19
            "type": "api",
20
            "domain": "yourcompany.com",
21
            "checks": [
22
                "third_party_apps",
23
                "drive_sharing",
24
                "admin_roles",
25
                "api_access"
26
            ]
27
        },
28
        {
29
            "name": "Salesforce",
30
            "type": "api",
31
            "instance": "na100.salesforce.com",
32
            "checks": [
33
                "api_permissions",
34
                "data_export",
35
                "user_permissions",
36
                "sharing_rules"
37
            ]
38
        }
39
    ]
40

41
    for app in integrations:
42
        setup_casb_integration(app)
43
        schedule_security_scans(app["name"], frequency="daily")

1
# Export logs to SIEM
2
import asyncio
3
import aiohttp
4

5
async def stream_logs_to_siem():
6
    """Stream Zero Trust logs to SIEM"""
7

8
    webhook_url = "https://api.cloudflare.com/client/v4/accounts/{}/stream"
9
    siem_endpoint = "https://siem.yourcompany.com/api/cloudflare"
10

11
    async with aiohttp.ClientSession() as session:
12
        # Configure log streaming
13
        config = {
14
            "destination": siem_endpoint,
15
            "dataset": "access_requests",
16
            "enabled": True,
17
            "frequency": "realtime",
18
            "format": "json",
19
            "fields": [
20
                "timestamp",
21
                "user_email",
22
                "app_name",
23
                "action",
24
                "ip_address",
25
                "country",
26
                "device_id",
27
                "risk_score"
28
            ]
29
        }
30

31
        async with session.post(
32
            webhook_url.format(ACCOUNT_ID),
33
            headers=headers,
34
            json=config
35
        ) as response:
36
            print(f"Log streaming configured: {response.status}")
37

38
# Parse and analyze logs
39
def analyze_access_patterns():
40
    """Analyze access patterns for anomalies"""
41

42
    query = """
43
    SELECT
44
        user_email,
45
        COUNT(*) as access_count,
46
        COUNT(DISTINCT app_name) as unique_apps,
47
        COUNT(DISTINCT ip_address) as unique_ips,
48
        COUNT(DISTINCT country) as unique_countries,
49
        AVG(risk_score) as avg_risk
50
    FROM access_logs
51
    WHERE timestamp > NOW() - INTERVAL '1 hour'
52
    GROUP BY user_email
53
    HAVING
54
        unique_countries > 2 OR
55
        avg_risk > 50 OR
56
        access_count > 100
57
    """
58

59
    suspicious_users = execute_query(query)
60

61
    for user in suspicious_users:
62
        trigger_security_alert(user)

1
// Grafana dashboard configuration
2
const dashboardConfig = {
3
  title: "Cloudflare Zero Trust Analytics",
4
  panels: [
5
    {
6
      title: "Authentication Success Rate",
7
      type: "graph",
8
      query: `
9
        sum(rate(cf_access_requests_total{result="allow"}[5m])) /
10
        sum(rate(cf_access_requests_total[5m])) * 100
11
      `
12
    },
13
    {
14
      title: "Top Blocked Threats",
15
      type: "table",
16
      query: `
17
        topk(10,
18
          sum by (threat_type) (
19
            cf_gateway_blocked_total
20
          )
21
        )
22
      `
23
    },
24
    {
25
      title: "Device Compliance",
26
      type: "pie",
27
      query: `
28
        sum by (posture_check) (
29
          cf_device_posture_failures_total
30
        )
31
      `
32
    },
33
    {
34
      title: "Data Loss Prevention Hits",
35
      type: "heatmap",
36
      query: `
37
        sum by (dlp_profile, hour) (
38
          cf_dlp_matches_total
39
        )
40
      `
41
    }
42
  ]
43
};

1
# Prometheus alerting rules
2
groups:
3
  - name: zero_trust_security
4
    interval: 1m
5
    rules:
6
      - alert: HighFailedAuthentications
7
        expr: |
8
          sum(rate(cf_access_requests_total{result="deny"}[5m])) > 10
9
        for: 5m
10
        labels:
11
          severity: warning
12
        annotations:
13
          summary: High number of failed authentication attempts
14
          description: "{{ $value }} failed auth attempts in last 5 minutes"
15

16
      - alert: SuspiciousGeoLocation
17
        expr: |
18
          count by (user_email) (
19
            count_values by (user_email) ("country", cf_access_country)
20
          ) > 3
21
        for: 10m
22
        labels:
23
          severity: critical
24
        annotations:
25
          summary: User accessing from multiple countries
26
          description: "User {{ $labels.user_email }} accessed from multiple countries"
27

28
      - alert: DataExfiltrationAttempt
29
        expr: |
30
          sum by (user_email) (
31
            rate(cf_dlp_matches_total[5m])
32
          ) > 5
33
        for: 2m
34
        labels:
35
          severity: critical
36
        annotations:
37
          summary: Possible data exfiltration attempt
38
          description: "User {{ $labels.user_email }} triggered DLP {{ $value }} times"
39

40
      - alert: DeviceComplianceFailure
41
        expr: |
42
          cf_device_posture_failures_total > 0
43
        for: 15m
44
        labels:
45
          severity: warning
46
        annotations:
47
          summary: Device failing compliance checks
48
          description: "Device {{ $labels.device_id }} failing {{ $labels.posture_check }}"

1
def calculate_user_risk_score(user_email):
2
    """Calculate dynamic risk score for user"""
3

4
    factors = {
5
        'failed_logins': get_failed_login_count(user_email, hours=24),
6
        'unusual_location': check_geo_anomaly(user_email),
7
        'off_hours_access': check_time_anomaly(user_email),
8
        'sensitive_data_access': get_sensitive_access_count(user_email),
9
        'device_compliance': check_device_posture(user_email),
10
        'threat_intel_hits': check_threat_intelligence(user_email)
11
    }
12

13
    weights = {
14
        'failed_logins': 0.15,
15
        'unusual_location': 0.25,
16
        'off_hours_access': 0.10,
17
        'sensitive_data_access': 0.20,
18
        'device_compliance': 0.20,
19
        'threat_intel_hits': 0.30
20
    }
21

22
    risk_score = sum(
23
        factors[factor] * weights[factor]
24
        for factor in factors
25
    )
26

27
    # Apply dynamic policies based on risk
28
    if risk_score > 70:
29
        enforce_step_up_authentication(user_email)
30
        notify_security_team(user_email, risk_score)
31
    elif risk_score > 50:
32
        increase_logging_verbosity(user_email)
33
        require_justification(user_email)
34

35
    return risk_score

1
// Dynamic policy adjustment
2
class AdaptiveAccessControl {
3
  constructor() {
4
    this.riskThresholds = {
5
      low: 0,
6
      medium: 30,
7
      high: 60,
8
      critical: 80
9
    };
10
  }
11

12
  async evaluateAccess(request) {
13
    const user = request.user;
14
    const resource = request.resource;
15
    const context = await this.gatherContext(user);
16

17
    const riskScore = await calculateRiskScore(context);
18
    const sensitivity = await getResourceSensitivity(resource);
19

20
    // Adaptive response based on risk
21
    if (riskScore > this.riskThresholds.critical) {
22
      return {
23
        decision: 'deny',
24
        reason: 'Risk score exceeds threshold'
25
      };
26
    }
27

28
    if (riskScore > this.riskThresholds.high && sensitivity === 'high') {
29
      return {
30
        decision: 'challenge',
31
        requirements: ['mfa', 'manager_approval', 'justification']
32
      };
33
    }
34

35
    if (riskScore > this.riskThresholds.medium) {
36
      return {
37
        decision: 'allow',
38
        conditions: {
39
          sessionDuration: '1h',
40
          monitoring: 'enhanced',
41
          restrictions: ['no_download', 'watermark']
42
        }
43
      };
44
    }
45

46
    return {
47
      decision: 'allow',
48
      conditions: {
49
        sessionDuration: '8h',
50
        monitoring: 'standard'
51
      }
52
    };
53
  }
54

55
  async gatherContext(user) {
56
    return {
57
      location: await getUserLocation(user),
58
      device: await getDeviceInfo(user),
59
      behavior: await getBehaviorAnalytics(user),
60
      timeOfAccess: new Date(),
61
      recentActivity: await getRecentActivity(user)
62
    };
63
  }
64
}

1
migration_phases:
2
  phase_1:
3
    name: "Pilot Group"
4
    duration: "2 weeks"
5
    users: 50
6
    applications:
7
      - Internal wiki
8
      - Development tools
9
    success_criteria:
10
      - User satisfaction > 80%
11
      - Zero security incidents
12
      - Connection success > 99%
13

14
  phase_2:
15
    name: "IT and Engineering"
16
    duration: "4 weeks"
17
    users: 500
18
    applications:
19
      - All development tools
20
      - Cloud consoles
21
      - CI/CD systems
22
    success_criteria:
23
      - Support tickets < 5% of users
24
      - Performance metrics match or exceed VPN
25

26
  phase_3:
27
    name: "Business Units"
28
    duration: "6 weeks"
29
    users: 2000
30
    applications:
31
      - Business applications
32
      - Collaboration tools
33
      - Financial systems
34
    success_criteria:
35
      - User adoption > 95%
36
      - Security posture improved
37

38
  phase_4:
39
    name: "Global Rollout"
40
    duration: "8 weeks"
41
    users: "All"
42
    applications:
43
      - All corporate resources
44
    success_criteria:
45
      - VPN fully decommissioned
46
      - Cost savings realized
47
      - Security KPIs met