Share This Article
As we’re seeing now, IT departments need architectures that allow them to provision users, manage those users’ devices, and control access from any location.
Although most organizations likely won’t shift to remote work permanently, we predict that their shift to cloud infrastructure has staying power — and we envision an architecture that helps organizations reduce their dependence on physical servers and other on-premises infrastructure, as well as increase their flexibility and resiliency.
In practice, this architecture will allow organizations to replace legacy directory services with entirely cloud-based infrastructure and create the domainless enterprise. In this post, we’ll take a closer look at the domain-bound enterprise of the past and the new approach to IT security in the modern domainless enterprise.
The Domain-Bound Enterprise
In the era of the domain-bound enterprise, admins controlled a server room and managed in-office workers and devices. Workers came into the office and logged into workstations, through which they accessed the internal network and their assigned resources.
Organizations relied on the internal network — their domain — to protect resources and data. This model served as the perimeter around organizational data, and it worked well until laptops and mobile devices, SaaS applications, and other technological advancements punched holes in the traditional domain.
Then, admins were forced to tie new resources back to their on-prem directory instances, usually Active Directory®, with identity bridges. They required these identity bridges to federate core identities from AD to these new resources, like web apps and Mac® machines. Separately, they required various solutions, like VPN tunnels and RDP ports, to connect remote and distributed users to the internal network and allow access to resources such as on-prem file servers. Although this model required complex vendor management and networking, it still served organizations with traditional offices and few users in the field. However, as organizations rapidly shift to remote work now, the security risks in this approach have become more pronounced — with a dramatic spike in both publicly accessible RDP ports and exposed VPNs.
In the domainless enterprise, though, IT operations are as seamless on-prem as they are off-prem.
The Domainless Enterprise
In a domainless enterprise, the focus shifts from an internal network to each device, with granular access permissions for each user, instead. This approach is more secure because it treats all users as untrusted and requires them to verify who they are to access their system, and again to access applications or other resources. In effect, their identity is asserted and verified each time they access a new resource or network. This process is the same regardless of where they’re located.
Organizations can protect each resource and access point with multi-factor authentication (MFA) and/or SSH keys (where applicable), ensuring users can’t travel laterally through an internal corporate network. That way, even if a user’s credentials are compromised, each access point has another layer of protection in MFA, and admins can quickly suspend user access across their environment.
The architecture for this type of enterprise is built on a cloud directory service, which natively integrates with all IT resources in any given environment and doesn’t require on-prem infrastructure to function. From a cloud directory service, admins can federate a core identity for each user where it’s required and secure their devices.
In the as-a-Service delivery model, too, organizations are guaranteed automatic redundancy, high availability, and predictable costs.
Admin Workflow in the Domainless Enterprise
With identity and access management (IAM) in the cloud, admins can manage users, devices, and access permissions from anywhere via a web-based console. They don’t have to worry about installing a backup domain controller, replacing servers when they reach their end of life, or tunneling remote users into an internal network.
Beyond that, the cloud directory service can serve as the backing directory for virtually all resources. It might pass certificates rather than actual credentials — as with SAML assertions — but all authentication routes through the directory without the need for identity bridges or third-party vendors.
From the web console, admins can oversee user lifecycle management, including provisioning and deprovisioning, and device management, including deployment of system policies. They can also return telemetry with key data about how their systems are functioning.
End User Workflow in the Domainless Enterprise
End users can log into their systems with their core credentials and a second factor of authentication, if required, regardless of where they are and whether or not they have an internet connection. They can also securely update their passwords via their machines, which reduces the likelihood they’re tricked by a phishing email or other browser-based attack.
Once logged into their systems, they can log into a web-based portal for single sign-on (SSO) to SaaS apps, again using their core credentials + MFA. They can access cloud server infrastructure and mission-critical data — if they need to do so to complete their jobs — with SSH keys that are also managed in the central directory.
They may still be advised to use a VPN to encrypt traffic over unsecured networks, but aren’t forced to use a VPN connection otherwise. This reduces friction because, although they need to authenticate to the VPN when required, they only need to remember one set of secure credentials.
At JumpCloud®, we strive to build IT architectures that enable secure workflows for both admins and end users. Our Directory-as-a-Service® can help organizations go domainless, securely. Click here to learn more about the concept of the domainless enterprise and how it can serve your organization.
