Networks and network devices shall be secured, managed and controlled to protect information in systems and applications.
Networks are segmented by environment (production, test, development) and by application tier. Firewalls, and Kubernetes NetworkPolicies control traffic flows, including restrictions to prevent cross-pod communication unless explicitly allowed, limiting access to only authorized systems and users.
All internal and external communications use encrypted protocols (TLS, VPN, SSH). Remote access is enforced through Keycloak/Netbird and SSH bastion hosts (outgoing and incoming options), with mandatory YubiKey Zero Trust authentication requiring blink + PIN for strong multi-factor verification, ensuring robust authentication and audit trails.
Network activity is logged and monitored for anomalies using Prometheus, Loki, and alerting pipelines. Suspicious events trigger automated alerts to operational teams via mattermost channel where we get notified about the alerts/incidents via our in-house alert processor and dispatcher tool opsmondo.
Network device firmware and configurations are updated within defined service windows, following staged rollouts and testing to maintain operational stability and security.