Complete architecture illustrations as per sketches

[enclave-marc-barry]

Additional sketches to be confirmed, but they should follow the same style as the existing SDP and ZTON illustrations.

Architectures to illustrate from sketches:

• [ ] Host-based Firewall Control
• [ ] Identity Aware Reverse Proxy
• [ ] Identity Defined Network
• [ ] Privileged Access Management

Host-based Firewall Control

Identity Aware Reverse Proxy

Identity Defined Network

Privileged Access Management

---

For context, we already have the ZTON and SDP architectures drawn:

SDP

To do:

• Add open ports
• Show direction of data flow
• Highlight areas where ZeroTrust principles stop applying
• SDP Connecor is spelt wrong (missing a T)

ZTON

To do:

• Add open ports
• Show direction of data flow

[enclave-alistair]

Some in-progress extra detail from Marc: https://miro.com/app/board/uXjVOxJlpyQ=/

[enclave-marc-barry]

Some thoughts on how to approach this first pass. I don't think we'll get it right first time, so propose we hedge our bets and aim for the simplest version first.

As these graphics are scrolled, in the first instance I'd aim to weight towards visual consistency, or as much as is possible. That might mean playing around with the location of boxes, arrows etc.

• Emphasise placement of the components in a consistent manor across the diagrams. Let's keep representation of the flows simple, data channels can be shown as bi-directional but as solid lines and control channels can be shown as bi-directional, but as dashed lines.

Once we've got that initial set of diagrams, we can iterate.

• Can we distinguish between connection initiation and data flowing?
• Can we show components that are internet facing to give a flavour of the attack surface for each architecture?
• Can we animate any of the flows in a similar way to https://reactflow.dev/ ?

[DanPinn]

@enclave-marc-barry

I've created the first drafts of the architecture diagrams, and saved the SVG files on the G Drive... https://drive.google.com/drive/folders/1FKaRsYtzBb6xa8qMhRg_1czIeEGdqY0D?usp=sharing

Link to the Figma File

Identity Aware Reverse Proxy Diagram

Host-based Firewall Control

Identity Defined Network Diagram

Privileged Access Management Diagram

SDP Diagram

ZTON Diagram

[enclave-marc-barry]

Thanks Dan, couple of tweaks:

• [x] Can all of the databases be labelled IdP please
• [x] Can Host - 1 (User) in ZTON diagram be changed to a user icon and be labelled just Host 1
• [x] Can Initiating Host (User) in SDP diagram be changed to a user icon and be labelled just Initiating Host please
• [x] Can the user icon in PAM diagram be labelled User please
• [x] Can hosts 1-3 boxes in IDN diagram be the same colour as other host boxes please. Can we also centre align "Network / Subnet / VPN" in each of the containers in this diagram. Can we also have three separate arrows arriving at the relay, not merging into one
• [x] Can Site-to-site be site-to-site in the HBFW diagram
• [x] Can you also centre align "Network / Subnet / VPN" text in the IAP diagram and label the user icon as User please. Can we also go with "Host x" in this diagram not "Server x" pls

[enclave-marc-barry]

Excellent, thanks for the updated diagrams Dan. Almost there!

• [x] The PAM data channel arrows are pointing the wrong way, should be pointing at the open port on host 1 and 2
• [x] The PAM data channel need to be labelled as step 3. from the miro
• [x] Could we change the words on HBFW graphic to read "Traditional site-to-site, client-to-site VPN, or LAN" - sorry that's my oversight
• [x] IDN doesn't look quite right because the text "Network / Subnet / VPC" intersects the control channel, would be nice to see if we can work around that somehow, but can see this one might be tricky...
• [x] SDP diagram has Accepting Hosts 1 and 2 shown twice with the same numbers in top and bottom boxes, bottom box should be number 3. We can remove "Accepting Host 4" all together, just like in this diagram
• [x] Some of the graphics (ZTON for example) are inconsistent, some systems are shown as Host 1 others have a dash, Host-1 would be good to standardise

Loving these graphics, super high quality. Looking so good!

[enclave-marc-barry]

@enclave-alistair and @enclave-tom please can you also cast a technical eye over the architecture graphics here would be fantastic if there's only one more pass for @DanPinn to do tomorrow

[DanPinn]

@enclave-marc-barry I've made all those amendments to the diagrams and re-uploaded to the G Drive... https://drive.google.com/drive/folders/1FKaRsYtzBb6xa8qMhRg_1czIeEGdqY0D?usp=sharing

Just need to create the favicon.

[DanPinn]

@enclave-marc-barry hope this is okay for the favicon? Saved here on the G Drive... https://drive.google.com/drive/folders/1-78xNV4p2ZP9jjsB30xNDW0bWjRwqaxF?usp=sharing

[enclave-marc-barry]

I'll drop it into build and we can see how it looks in the tab, give me a few mins