Aventura, Florida · serving clients across the United States (305) 404-9404Toll-free (800) 767-8566Emergency? Get a call within 1 hour
Global consulting & standards

One team for three countries

A global sustainability consulting and standards firm operating in three countries, a leader in its segment.

Scale
3 countries, 50+ employees
Engagement
Full management

The challenge

Offices in three countries, part on-premises and part in the cloud, with one standard of security and support.

Three countries mean three sets of local conditions and one expectation of consistency. Staff in each office received the same help desk, device management and security controls, regardless of where their servers sat.

Mixing on-premises and cloud systems is common and difficult to secure. Designing identity, backups and email as one coherent environment kept the mix manageable and made a single support team viable.

What our team delivered

  • In-house and cloud infrastructure
  • Workstations, phone system and help desk
  • Backups and email on our enterprise mail architecture
  • Security and device management across every country

Result

Everything from workstations to the phone system, and from backups to the help desk, managed by one team.

Every sign-in, verified

Staff sign in once, but behind the scenes the device, the identity, a phone approval and your access policy are all checked before any app opens, and strangers are turned away.

Every sign-in, verifiedDiagram of user authentication. A user signs in; the device is checked for MDM and Intune compliance; the identity provider, Active Directory or Entra ID, verifies the account; an MFA push is approved on the user's phone; conditional access evaluates the policy; and access is granted to email, ERP and files. On a second pass, a sign-in from an unknown device in a new location is blocked by the conditional access policy. VERIFIED SIGN-INUserSigns inDevice checkMDM · IntuneIdentityAD · Entra IDMFA pushPhone approvalConditionalaccessPolicy checkEmailERPFilesUnknown deviceNew locationApprove?Blocked

Mail that keeps flowing

Incoming mail is authenticated and scanned before it reaches anyone, mailboxes are copied across three regions so a server failure goes unnoticed, and outgoing mail leaves signed and encrypted.

Mail that keeps flowingDiagram of enterprise email flow. Inbound mail from an internet sender reaches the MX edge server running Postfix, where SPF, DKIM and DMARC checks light up in sequence, then passes a spam and malware filter; a spam message is diverted to quarantine. Clean mail is delivered to a mailbox cluster, a database availability group with copies in three regions. On a loop the active server in region A fails and the copy in region B activates automatically, so the next message is still delivered. Outbound mail from the user's mailbox is DKIM-signed and sent over an encrypted TLS connection to the recipient. INBOUNDOUTBOUNDSenderInternetMX edgePostfixSPFDKIMDMARCThreat filterSpam · malwareQuarantineMAILBOX CLUSTER · DAGRegion ARegion BRegion CActiveCopyActiveCopyMailboxUser inboxDKIM signingTLS encryptedRecipientSPFDKIMDMARCSPFDKIMDMARCOffline

DMARC: from watching to rejecting

Share of mail claiming the domain that passes DMARC (SPF or DKIM aligned), week by week. In the monitoring phase (p=none) reports reveal forgotten senders; each one gets SPF and DKIM fixed. Quarantine sends failures to spam, reject refuses them at the receiving server. Illustrative figures.

DMARC: from watching to rejectingLine chart over 12 weeks. DMARC pass rate climbs from 61 percent in week 1 to 78 percent at the end of the p=none phase, 94 percent at the end of p=quarantine, and 99.1 percent in week 12 under p=reject.DMARC pass rate, 12 weeksp=nonemonitor onlyp=quarantinefailures to spamp=rejectfailures refused50%60%70%80%90%100%W1W2W3W4W5W6W7W8W9W10W11W1261%78%94%99.1%Week number on the x axis. Pass rate is measured on aggregate (rua) reports.

Frequently asked questions

Direct answers to the questions we hear most. Something else on your mind?

Send us a message
How were three countries kept to one standard?

One team managed security, device management and support across every country. The consultancy had offices in three countries and more than 50 employees, with a mix of in-house and cloud infrastructure.

What did the managed scope include?

Workstations, the phone system and help desk, backups, and email on our enterprise mail architecture. The case summarizes it as everything from workstations to the phone system and from backups to the help desk.

Was the infrastructure on-premises or in the cloud?

Both. The case covers in-house and cloud infrastructure managed under the same standard of security and support.

Do you know if your company is safe?

Speak with a security engineer today. The first assessment call is free and confidential.

CallFree assessment