Skip to main content
Review and revision metadata
Review Date: 2026-07-05
Reviewer: Solution Architect

previous version on gdrive

A.8.22 Segregation of Networks

Control Objective​

Groups of information services, users and information systems shall be segregated in the organisation’s networks.

Policy Statement​

anDREa enforces strict multi-tenant network segregation to prevent unauthorized lateral movement, data spillover, or cross-contamination between environments. Network assets, user sessions, and backend information services are logically and structurally isolated from one another through multi-layered cloud subscriptions and distinct cloud provider architectures.

Network Segregation Architecture​

Our isolation model operates across two primary domains: platform delivery (myDRE) and internal corporate operations.

1. Platform & Tenant Segregation (myDRE / Microsoft Azure)​

The myDRE platform implements a multi-tiered containment strategy within Microsoft Azure to ensure that data and compute workloads remain completely compartmentalized:

  • Tenant Isolation: Every customer organization operates within its own dedicated boundary. Subscriptions and virtual networks (Vnets) are explicitly separated by tenant, ensuring that one customer cannot view, intercept, or access the infrastructure of another.
  • Subscription Separation: Within a single tenant, infrastructure workloads are segregated into separate Azure subscriptions. Deployed research Workspaces reside in a standalone subscription entirely distinct from the subscription hosting shared administrative infrastructure (such as software deployment shares or archival storage).
  • Workspace Segmentation: At the lowest layer, individual myDRE Workspaces are bound to their own isolated network subnets regulated by strict Network Security Groups (NSGs). This blocks lateral network communication between different project workspaces unless explicit peering is technically approved and established.

See:

2. Corporate & Operational Segregation​

To prevent an incident in the corporate office environment from impacting production software libraries or customer research data, anDREa splits its core business operations across distinct cloud hyperscalers:

  • Corporate Office Work: General business management, financial processing, HR documentation, and office communications execute exclusively within the Google Workspace cloud ecosystem.
  • Development & Platform Services: Core software engineering, version control tracking, CI/CD deployment pipelines, and primary myDRE services run exclusively within GitHub and Microsoft Azure.
note

There are no shared internal networks, bridging protocols, or local infrastructure nodes connecting these corporate and development environments.