{"id":624,"date":"2026-09-22T01:22:20","date_gmt":"2026-09-22T01:22:20","guid":{"rendered":"https:\/\/ycybersolutions.ca\/?page_id=624"},"modified":"2026-09-23T01:37:17","modified_gmt":"2026-09-23T01:37:17","slug":"cybersecurity","status":"publish","type":"page","link":"http:\/\/ycybersolutions.ca\/?page_id=624","title":{"rendered":"Cybersecurity"},"content":{"rendered":"\r\n

SERVICES \/ CYBERSECURITY & IDENTITY<\/p>

Design security into the systems your organization relies on.<\/h1>

Security architecture, zero trust, identity, API security, threat modeling and secure delivery.<\/p>Start a conversation \u2197<\/span><\/a><\/div><\/section>

IN PRACTICE<\/p>

The work behind the outcome<\/h2>
01<\/span>

Map the exposure<\/h3>

Identify internet-facing services, privileged routes, sensitive data paths and trust boundaries before selecting controls.<\/p><\/div>

02<\/span>

Design enforceable policy<\/h3>

Define inbound and east-west flows, ownership, default-deny rules, exceptions and a process for testing change.<\/p><\/div>

03<\/span>

Prove the control<\/h3>

Test allowed and denied paths, verify telemetry reaches monitoring, and review rules against actual application behavior.<\/p><\/div><\/div><\/div><\/section>

ANIMATED DELIVERY PATH<\/p>

How the work moves from insight to action<\/h2>

An animated view of the major decision points. Each stage produces evidence for the next.<\/p>

<\/span><\/div>
<\/svg><\/span>01<\/small>

Discover<\/h3>

Map assets, identities and exposed paths.<\/p><\/article>

<\/svg><\/span>02<\/small>

Model<\/h3>

Make trust boundaries and traffic flows visible.<\/p><\/article>

<\/svg><\/span>03<\/small>

Enforce<\/h3>

Apply identity, firewall and API policy.<\/p><\/article>

<\/svg><\/span>04<\/small>

Observe<\/h3>

Correlate telemetry and test control behavior.<\/p><\/article>

<\/svg><\/span>05<\/small>

Respond<\/h3>

Contain impact and restore trusted service.<\/p><\/article><\/div>

Stage 01<\/b> of 05 \u00b7 Discover<\/span><\/div><\/div><\/div><\/section>

CAPABILITIES<\/p>

Where we focus<\/h2>
\u25c6<\/span>

Security architecture and zero trust roadmaps<\/h3><\/div>
\u25c6<\/span>

Identity and access design across workforce and customer journeys<\/h3><\/div>
\u25c6<\/span>

API threat modeling and secure development review<\/h3><\/div><\/div><\/div><\/section>

REFERENCE PATTERNS<\/p>

Security architecture, illustrated<\/h2>

These reference patterns show where firewall rules, segmentation and access decisions can be enforced. Actual design depends on your network, applications and risk assessment.<\/p>

01 \/ Internet-facing application<\/b>Filter at the edge, isolate the public tier, and limit access to data.<\/span><\/figcaption>
Internet<\/strong>Untrusted requests<\/small><\/div>
\u2192TLS<\/small><\/div>
WAF + edge firewall<\/strong>Web rules \u00b7 rate limits<\/small><\/div>
\u2192Allowed traffic<\/small><\/div>
DMZ \/ reverse proxy<\/strong>Public entry point<\/small><\/div>
\u2192Specific ports<\/small><\/div>
App firewall<\/strong>Explicit allow rules<\/small><\/div>
\u2192<\/div>
App + data tiers<\/strong>Private segments<\/small><\/div><\/div>

Deny unused inbound paths. Send WAF, firewall and application events to monitoring; review rules and exceptions regularly.<\/p><\/figure>

02 \/ Internal segmentation<\/b>Separate workloads and make east-west access intentional.<\/span><\/figcaption>
User zone<\/strong>Workstations<\/small><\/div>
\u2192Approved app access<\/small><\/div>
Internal firewall<\/strong>Identity \u00b7 service \u00b7 port policy<\/small><\/div>
\u2192Only required flows<\/small><\/div>
Application zone<\/strong>Services and APIs<\/small><\/div>
\u2192Restricted service<\/small><\/div>
Data firewall<\/strong>Least privilege<\/small><\/div>
\u2192<\/div>
Data zone<\/strong>Sensitive records<\/small><\/div><\/div>
\u2715<\/span> Direct workstation-to-database access and unnecessary lateral traffic are blocked.<\/div><\/figure>
03 \/ Identity-aware access<\/b>Check each request before it reaches a protected application.<\/span><\/figcaption>
User + device<\/strong>Identity \u00b7 posture<\/small><\/div>
\u2192Request<\/small><\/div>
Policy decision<\/strong>MFA \u00b7 context \u00b7 risk<\/small><\/div>
\u2192Authorize<\/small><\/div>
Access proxy<\/strong>Policy enforcement<\/small><\/div>
\u2192Scoped session<\/small><\/div>
Application<\/strong>Private resource<\/small><\/div><\/div>

Record the decision and session activity. Re-evaluate access when context changes and restrict tool or API permissions to the task.<\/p><\/figure>

Conceptual patterns informed by CISA network segmentation guidance<\/a> and NIST SP 800-207<\/a>.<\/p><\/div><\/section>

INTERACTIVE STORY<\/p>

How a ransomware attack unfolds<\/h2>

Follow a simplified ransomware scenario and see how layered controls can interrupt it. Use the controls to move through the story.<\/p>