Securing Access by Policy
The Context
David is the CIO of a pharmaceutical laboratory with 120 employees. Following an attempted intrusion from a foreign country, management asks him to strengthen access controls. Certain critical applications — patient data, clinical trial results — should only be accessible under strict conditions.
The Problem Without VaultysHub
- SaaS applications are accessible from any device, anywhere
- No way to restrict access by geographical location
- Impossible to ensure that the devices used are compliant
- Traditional VPNs are cumbersome to manage and degrade user experience
With VaultysHub
Step 1 — Define Access Policies (DAP)
David configures Device Access Policies in VaultysHub. For critical applications, he defines:
- Allowed Browsers: only Chrome and Firefox (latest versions)
- Operating Systems: Windows 10+ and macOS 12+
- Allowed IP Ranges: only the company's network and the VPN
- VaultysID Security Level: mandatory biometric authentication
Step 2 — Apply Policies by Folder
David associates these policies with the folders containing sensitive applications. The "Clinical Data" folder requires the highest security level, while the "Daily Tools" folder (Slack, email) remains accessible from any secured device.
Step 3 — Real-Time Verification
When a researcher attempts to access clinical data from a café using their personal computer, VaultysHub blocks access and displays an explanatory message. From their workstation in the lab with their biometric VaultysID, access is immediate.
Step 4 — Traceability and Reporting
Every access attempt — successful or denied — is recorded in the Audit Trail. David filters for Bastion events (approval requests, successful authentications, denials) to monitor suspicious attempts. The access attempt from the café appears as "Connection Denied" with the IP, browser, and OS used.
Each month, David reviews the RSSI report which summarizes security incidents, including access blocked by Bastion policies.
What Changes
| Without VaultysHub | With VaultysHub |
|---|---|
| Access possible from anywhere | Control by IP, browser, OS |
| No device verification | Policy by VaultysID security level |
| Cumbersome and restrictive VPN | Granular control without VPN |
| Uniform rules for everyone | Differentiated policies by folder |
| No visibility on access attempts | Logging of each attempt (success/denial) |
| No security reporting | Monthly RSSI report with Bastion incidents |
Features Used
- Access Policies (DAP) — Rules by browser, OS, IP, and security level
- Folder Management — Applying policies by folder
- VaultysID — Security levels (passkey, biometrics, hardware key)
- Logging — Traceability of access attempts and Bastion events
- Reports — RSSI report with security incidents