A county government's segmented network and passkeys: from flat to default-deny in two budget cycles
A county government in the United States with a population of several hundred thousand, a leader in its segment.
- Scale
- About 25 departments, 2,500 staff, 60 buildings, segmented by department, passkeys for all staff
- Engagement
- Two budget cycles of design, rollout and handover
The challenge
Twenty-five departments had built their own networks and systems over decades. Public safety, courts, building systems, finance and guest Wi-Fi shared a flat core, and staff signed in with passwords that phishing kits could steal. A ransomware attack on a neighboring county had put the commissioners on notice, and the central IT team had a small staff and a public purchasing process.
A county with several hundred thousand residents ran twenty-five departments, 60 buildings and about 2,500 staff on a network that had grown by department. Public safety, the courts, building controls, finance and guest Wi-Fi shared a flat core. Staff signed in with passwords and text-message codes that phishing kits routinely steal. A ransomware attack on a neighboring county had put the commissioners on notice, and the central IT team was small and bound by a public purchasing process.
The first months went to listening. We inventoried the network and sat with each department head to learn how work moves: which clerk needs which system, which vendor connects from where, which device must never be reached from the internet. The design followed those flows instead of an org chart. VRFs and VLANs separate departments, public safety, courts, building systems, guests and administration, with a default-deny firewall between them and logged exceptions that the owner of each system approves.
The sheriff's office got its own enclave. Law enforcement systems carry rules that the state agency sets, so the county built the enclave to the agency's published requirements and manages it only as far as the agency allows. We did not take on those rules ourselves, and the design keeps the enclave's boundary simple enough to audit.
Sign-in changed next. Passkeys use FIDO2 and WebAuthn, where the private key stays on a device and the site gets a signature bound to its own domain, so a phishing site cannot collect a usable credential. Administrators and the finance team received hardware security keys, other staff use passkeys on managed devices and phones, and the old passwords and SMS codes were retired in stages. An identity-aware gateway replaced the legacy VPN for internal applications and checks both the person and the device before it opens a path.
Recovery and handover closed the work. Immutable, tested backups protect finance, records and permit systems, and a recovery order agreed in writing with the department heads says which service returns first. Everything was written as a procurement-ready scope that fit two budget cycles, with templates the central team can reuse for a new building. A one-page risk view for the commissioners replaced a thick binder. Sizes and durations in this illustrative case are modeled for an engagement of this kind. Our zero trust and passkey articles explain the design.
What our team delivered
- A network inventory and a data-flow review with each department head, so the design followed how work really moves
- Segmentation with VRFs and VLANs for departments, public safety, courts, building systems, guest and administration, with a default-deny firewall between them and logged exceptions
- A separate enclave for the sheriff's office, built to the requirements its state agency sets and managed by the county only as the agency allows
- Passkeys using FIDO2/WebAuthn: security keys for administrators and the finance team, platform passkeys on managed devices and phones for other staff, with the old passwords and SMS codes retired in stages
- Zero trust access to internal applications through an identity-aware gateway that checks the user and the device, replacing a legacy VPN
- Immutable, tested backups for finance, records and permits systems, and a recovery order agreed in writing with the department heads
- A procurement-ready scope and a handover so the central team could operate everything and renew licenses without us
Result
A compromised workstation in one department could no longer reach another, phishing could no longer harvest a usable credential, the commissioners had a one-page view of risk, and the IT team could run the network from templates. Sizes and durations are modeled for an engagement of this kind, not measurements from a client.
Access to one app, not to the network
Zero trust network access replaces the all-or-nothing VPN. The identity provider proves who you are, the device agent proves the laptop is healthy, the policy engine decides, and the enforcement point opens a tunnel to that single application and nothing else.
Separate by region and by business unit
Each business unit lives in its own VRF and VLAN in every region, so a problem in retail cannot reach finance. Traffic between units has to pass a firewall that denies by default and allows only what is written down.
Every sign-in, verified
Staff sign in once, but behind the scenes the device, the identity, a phone approval and your access policy are all checked before any app opens, and strangers are turned away.
Defense in depth, on a loop
Every device on your network sits behind a monitored firewall with two internet circuits, so attacks are stopped at the door and a provider outage does not stop the business.
Facing something similar?
Tell us about your environment. We will tell you plainly what we would do and what it would take.