ZTA-01
Identity Governance & Phishing-Resistant MFA
Deploying SSO, OAuth2/OIDC, conditional access, and FIDO2/WebAuthn hardware keys across all corporate and legacy apps.
Request Specification
CYB-03 // ZERO-TRUST ARCHITECTURE
Zero-Trust Network Access (ZTNA), Micro-Segmentation & Identity Governance
Replace vulnerable legacy VPNs and flat internal networks with NIST SP 800-207 Zero-Trust architecture—enforcing continuous identity verification, hardware MFA, least-privilege micro-segmentation, and Privileged Access Management (PAM).
NIST SP 800-207 Aligned
VPN-Less ZTNA Remote Access
East-West Micro-Segmentation
Privileged Access (PAM) Vaults
ZERO-TRUST ARCHITECTURE // NIST 800-207
100%
Elimination of Flat VLAN Trust
Zero
Exposed Public VPN Concentrators
100%
Recorded Privileged Admin Sessions
< 5ms
Identity Proxy Access Overhead
NEVER TRUST, ALWAYS VERIFY
Why Flat Internal Networks Are an Attacker's Playground—And How Zero-Trust Stops Them
In a traditional castle-and-moat network, once an attacker compromises a single receptionist laptop or steals a VPN password, they have flat, unrestricted network access to scan and encrypt every server in the building.
Dulo Tech engineers true NIST SP 800-207 Zero-Trust architectures. Every user, device, and API call is authenticated, posture-checked, and granted encrypted access only to the specific single application requested—never the underlying network.
Replacement of Legacy VPNs With Device-Posture-Checked ZTNA Brokers
East-West Data Center & Campus Network Micro-Segmentation
Privileged Access Management (PAM) With Just-in-Time Session Recording
ZERO-TRUST ZTNA & PAM // MICRO-SEGMENTED
SLA: 99.999%
SIX PILLARS OF ZERO-TRUST
End-to-End Zero-Trust Implementation Across Identity, Device, Network & Data
We implement Zero-Trust systematically across CISA's and NIST's six foundational pillars.
ZTA-01
ZTA-02
Privileged Access Management (PAM)
Vaulting domain admin, database root, and firewall credentials with just-in-time approval and full video/keystroke session recording.
Request Specification
ZTA-03
Zero-Trust Network Access (ZTNA)
Replacing exposed SSL/IPSec VPNs with identity-aware application proxies from Fortinet, Palo Alto Prisma, Cloudflare, or Zscaler.
Request Specification
ZTA-04
Network NAC & East-West Micro-Segmentation
802.1X Network Access Control (Cisco ISE / Aruba ClearPass) and software-defined firewalling between every server workload.
Request Specification
ZTA-05
Device Posture & Endpoint Compliance
Blocking any laptop or mobile device from accessing corporate apps if its OS patch level, BitLocker encryption, or EDR agent is unhealthy.
Request Specification
ZTA-06
Data Loss Prevention (DLP) & mTLS
Enforcing mutual TLS between microservices and blocking unauthorized USB/cloud exfiltration of sensitive customer records.
Request Specification
ZERO-TRUST MATURITY ROADMAP
Six Phased Steps to Zero-Trust Without User Disruption
We roll out Zero-Trust in transparent, non-disruptive phases so employee productivity increases rather than suffers.
ZTR-01
Step 1: Protect-Surface & Asset Mapping
Identifying your 'crown jewel' databases, ERPs, and payment switches and mapping all legitimate traffic flows.
FLOW MAPPING
ZTR-02
Step 2: Strong Identity & MFA Rollout
Consolidating directories and enforcing conditional MFA and Single Sign-On across all user accounts.
SSO UNIFIED
ZTR-03
Step 3: Privileged Admin Lockdown
Eliminating standing domain-admin rights and routing all vendor and sysadmin access through a recorded PAM jump-host.
ADMIN LOCKDOWN
ZTR-04
Step 4: Monitor-Mode Segmentation
Deploying NAC and micro-segmentation policies in 'audit/log-only' mode first to verify zero legitimate business traffic is blocked.
ZERO DISRUPTION
ZTR-05
Step 5: ZTNA Cutover & VPN Retirement
Migrating remote staff and branch offices to ZTNA application connectors and shutting down public VPN ports.
VPN RETIRED
ZTR-06
Step 6: Continuous Adaptive Policy Tuning
Feeding live CSOC risk scores into the identity broker to automatically step-up authentication when anomalous behavior occurs.
ADAPTIVE TRUST
ZERO-TRUST SPECIFICATION MATRIX
Zero-Trust Control Domains & Reference Technologies
Architectural blueprint for Dulo Tech Zero-Trust deployments.
| Control ID | Zero-Trust Pillar | Legacy Vulnerability Replaced | Reference Technology Stack | Target Outcome |
|---|---|---|---|---|
| ZT-C1 | User Identity | Password Reuse & SMS Phishing | Entra ID P2, Okta, YubiKey FIDO2 | 100% Phishing-Resistant Auth |
| ZT-C2 | Privileged Access | Shared Root/Admin Passwords | CyberArk, BeyondTrust, Delinea, Teleport | Zero Standing Privileges + Video Audit |
| ZT-C3 | Remote Access | Exposed Public VPN Concentrator | FortiSASE, Palo Alto Prisma, Cloudflare ZTNA | Dark Perimeter (Zero Open Inbound Ports) |
| ZT-C4 | Campus LAN / Wi-Fi | Open RJ45 Wall Ports & PSK Wi-Fi | Cisco ISE, FortiNAC, Aruba ClearPass (802.1X) | Automated Quarantine of Unknown Devices |
| ZT-C5 | Data Center East-West | Flat Server VLANs | VMware NSX, Cilium eBPF, FortiGate Internal | Zero Lateral Movement Between Servers |
TECHNICAL KNOWLEDGE BASE
Frequently Asked Engineering & Procurement Questions
Direct answers from Dulo Tech Limited's Principal Systems Architects, CSOC Directors, and Institutional Procurement Officers at Mirage Towers, Nairobi.
Traditional VPNs expose a public listening port to the internet (frequently targeted by zero-day exploits) and, once connected, place the remote user's laptop directly onto the internal corporate network. ZTNA makes your network invisible to the internet and grants access only to specific apps.
No. During our Monitor-Mode discovery phase, we profile all non-interactive IoT devices, printers, and IP phones and assign them to dedicated, tightly ACL-restricted voice/print VLANs.
Instead of giving an external ERP or database vendor a permanent VPN and admin password, PAM grants them a time-bound, browser-based session to that single server while recording every command and keystroke for audit compliance.
In many cases, yes! Organizations often already own Entra ID, FortiGate/FortiClient, or Cisco capabilities that can be architected into a Zero-Trust fabric without buying overlapping tools.
Our phased roadmap delivers quick wins (MFA and PAM) in the first 3 to 4 weeks, followed by full ZTNA and micro-segmentation over 8 to 12 weeks.
Yes. PCI-DSS v4.0 and CBK guidelines explicitly mandate strict network segmentation of cardholder/core banking zones, multi-factor authentication, and privileged access logging.
Request a Zero-Trust Architecture workshop via the form below.
Need direct architectural clarification?
Call +254 799 000 595
DIRECT DISPATCH DESK
Request Technical Briefing or Tender BOQ Quote
Routed directly to our Senior Engineering Board at 12th Floor, Mirage Towers, Westlands, Nairobi.