Name: Whiteboarding Zero Trust: Advice and lessons from Swiss Post’s security transformation
Uploaded: 2026-03-10T14:30:55.140Z
Duration: 39 min 44 s
Description: Whiteboarding Zero Trust: Advice and lessons from Swiss Post’s security transformation

Transcript for "Whiteboarding Zero Trust: Advice and lessons from Swiss Post’s security transformation": Hi, everyone. I'm Martin Sanchez from CloudFront's marketing team. Welcome to this webinar on whiteboarding zero trust, featuring a great presentation and whiteboard session from Nikola Nova Selic, who is the senior enterprise cybersecurity and network architect at Swiss Post, Switzerland's National Postal Service. I'm really excited to introduce this session today because it illuminates and makes really concrete a concept that often feels kind of high level or even hand wavy. And that topic is network modernization and zero trust transformation. So let me set the scene for about three minutes, and then I'll get out of the way so Nikola can get to the good stuff. We're probably all familiar with the effects of cloud migration and hybrid work on the enterprise corporate network. As more workforce and network traffic transits the public Internet, know, traditional perimeter based security protections and network infrastructure, both start to run into some pretty serious problems. These challenges are what's been driving interest in SASE or Secure Access Service Edge over the past, you know, few years. Companies are realizing, you know, maybe I need to start treating the Internet like my corporate network. Maybe I should separate security from my data and compute infrastructure and unite a bunch of different workforce security and network services on a single platform. But an interesting side effect of all of that is that when you start thinking about the world like this, another traditional framework starts to break down. And that is the distinction between what's workforce facing and what's customer facing. So you can see a few examples here, but partners and suppliers are a really good example of this. They're not customers in the strictest sense. They are often treated as part of the greater workforce, because they need access to private network resources and applications. But they might also need to access parts of your public facing web application from their own devices and networks and over connections that you don't control, even less so, you know, than remote employees or something like that. And so suddenly, DDoS protection and web application vulnerability protection start becoming a more important part of the picture in terms of managing their access. With that shift, suddenly the traditional SASE protections aren't necessarily enough. Swiss Post, which is, again, the the National Postal Service of Switzerland, had exactly this realization over the course of their SASE journey, that employees and network infrastructure were only a part of the puzzle. They wanted to connect and secure everything in their network and everything accessing it to from a single platform rather than just connecting and securing their workforce. That's obviously a pretty tall order. SASE transformation, SASE adoption is already a tall order, and it's a multiyear process. And so with that, I think it's time for me to step back and let Nikola talk about how they're going about that. He recently joined us on stage at a Cloudflare event in Zurich to to whiteboard their whole network, how it's evolved, and how they're building that single platform in in order to more securely and connect everything and all of its complexity. The talk was received really well, so Nikola graciously agreed to make it available to people globally. So I'll let him take it away here, and then at the end, I'll rejoin quickly to share a few final thoughts. So Nikola, take it away. We're gonna do an interactive whiteboard. But before we start, let me kind of give you some telemetry. So last week, I presented at an event in Berlin, and I was trying to convince the audience that Swiss Post is the worst postal organization in the world. So after the event, my colleague told me maybe skip that part next time. So today, we're going straight to the point. And the point number one is according to the Universal Postal Union, which is the second oldest organization in the world, present in 192 countries, the Swiss Post is the best postal organization on the planet and we've been so for the last eight years holding the title since 2017. And second point, Swiss Post is third largest corporation in Switzerland employing about 70,000 people. Extremely diversified, which doesn't mean that we just have envelopes in different colours. We are active in lots of different business fields from logistics, naturally transportation, finance, real estate, lots of e government stuff, e voting, e health and so on and so forth. So the reason why I'm telling you this is to kind of to get the picture when we talk about complexity and compliance regulation requirement doesn't really go worse than this. So, let's jump into the whiteboard and we're gonna do the following. We will kind of sketch the baseline of Swiss Poles so you guys understand how does from a bird's eye view Swiss Poles function architecturally today. We will identify some problems and quantify the reasons why this needs to change and the transformation needs to happen. Then on this problem statement, we will create a solution target architecture that solves all these problems. And on that solution architecture, we will map technology, so we understand how to actually solve all of this. Okay. So let's get it started. Like I said, I'm kind of afraid of move these things, so I have to draw here on the side. So, okay, it works. So, let's start like this. Switzerland has two large data centers in, and we have this very robust established security stack where basically everything terminates in, everything goes through that. Now, besides having these two data centers, what we also have is a fairly large campus of about 3,500 locations. Now all of these locations connect to the data center like this. So it's MPLS, privately addressable, classic campus connectivity, redundant for big locations and so on and so forth. Now if we stopped right here, this would be how Swiss Post looked ten years ago and most other companies. But the world has drastically changed. So today a majority of our workloads actually run-in the cloud. So we have this huge deployment on two hyperscalers, one is AWS, the other one is Azure. And we connect to these ones partially to Direct Links or I think maybe only direct links. I have to talk with my connectivity colleagues who are somewhere here. And but basically, everything is deployed in a private backbone Kaldia way. So there is no way to consume anything from the these hyperscalers. You basically have to go through the data center to consume everything. And this already introduces some of our problems that we can look at right now. Now let's imagine that one of our campus location, maybe this one down here is a sorting centers. Sorting centers in SwissPOS are huge things. They are the size of two football fields full with IoT and OT technology. What they need to do is they need direct visibility of AWS where all the back end systems are running. But because of how the network is built and having no direct internet egress and having to route everything through the network, what actually happens is the path that this traffic takes is through the MPLS backbone, through the security stacks, through the integration pattern, the whole firewall chain, IDS, IPS until it terminates via Direct Connect on AWS and consumes the back end on the VPC. So all that works great. The problem is that between this point right here and that point right there, there are stacks and stacks of infrastructure where anything can fail or be misconfigured. And in fact, things like this, they happen. They happened in the past. So business continuity is suffering because of the lack of resilience. And the problem is that if this data center loses connectivity for one minute, what happens is that all the ramps are full. Packages have nowhere to go and everything stops, and hundreds of people can go have a charge at the coffee machine. Okay. But it gets a bit more complicated. So few years ago, the strategy of Swiss Post that was defined basically says that everything we do should be SaaS, software as a service before PaaS, platform as a service before infrastructure as a service before on prem. So today we have hundreds of SaaS applications everywhere. Yeah? And the way we connect to these applications, including PaaS and SaaS, is like this. Of course, everything terminates in the data center. So now what's happening here? I did just drew two lines, but there are hundreds of SaaS applicate there are hundreds of of lines. So we're drilling holes and holes in this perimeter, opening things and opening ports and enable to be able for to the business to continue working. Yeah? Now it gets a bit more complicated is because, and we don't have time to go into the reasons why, Swiss Post today has over 100 subsidiaries. Yeah? These sort of subsidiaries have their own infrastructure, have their own people, have their own employees. What we want to do, we want to integrate with these subsidiaries. But how do you integrate a subsidiary in a traditional architectural model? You swallow them, including the infrastructure and the employees and the contracts and all the good and bad and risk and so on and so forth. But the problem is when this highly decentralized distributed world, everything that you acquire sooner or later you want to give away. So if you will fully integrate a subsidiary when you want to carve it out, have huge problems getting rid of all that integration. So what we actually want is very loose coupling and data exchange without binding this and making it static. So actually, in today's architectural model, we don't have a proper way or a solution to solve this problem. So we talked a lot about infrastructure. Now let's add some people to the mix and see what happens. So let's put some tiny humans on this side, and let's give them all a role. Let's also put one system because we need APIs and internal systems and everything. So let's say that these humans are basically a private customer, a business customer, a partner, a supplier, an employee, and some kind of a system. So now how do these entities connect to Swiss Post? Well, actually, exactly as you would expect. Everything goes like this, terminates here. Looks normal. So suddenly we are now faced with a problem where we have requirements from our business that we simply cannot fulfil, like exposing a Kafka stream over the public internet without forcing our partners to implement a side to side VPN connection. Or we have highly distributed workforce, people working from everywhere. Swiss Post has this wonderful policy called Workation. So as an advertisement, if you guys want to work at Swiss Post, for two months you can travel the world, work part time and have holiday part time. It's an official model that we support. Wow. Okay, so the problem is since we have to push everything through the data center, the more beautiful the beach becomes, the worse connection it becomes. Latency is suffering, you can't really work and you have to say your boss, have connection problems, you know, maybe it's good for more relaxation in your holiday. There are lots of problems, so many great examples. So, will not dwell more on the problems. Let's start translating this into a solution. So, let me make some space here and maybe important to understand when we talk about Zero Trust. Today we've talked a lot about Zero Trust as a product. Yeah? When at SwissPulse we talk about Zero Trust, we are talking about three things: architecture, strategy and an operating model. So it's a bit confusing. Cloudflare calls their product Zero Trust. For us, it's an important cog in the grand scheme of things. So Zero Trust at Swiss Post actually has three phases, large phases. First of these ones, we call Zero Trust Foundation. We will look at this one today. Now Zero Trust Foundation itself, it's a monumental undertaking that is terminated to be fully delivered in all its components by 2029, software ready to install. Now that kind of confused me now. Yeah, so Zero Trust foundation consists of three building blocks. Now let's map them on this whiteboard to understand what's happening. So the first building block is located right here. It is something that we call Zero Trust Edge. Right? Now Zero Trust Edge basically has three parts. It has an ingress part. That's the part where everything from the left side connects to. It has an egress part. That's where we connect all our back end systems. So everything going here is connecting like this. And now this was said few times today, but not really explained. Like, what the hell is happening here? I mean, all the arrows are pointing at the green cloud. So how do we actually exchange data? So this was already explained, happens with CloudFront tunnels. What wasn't happened is what wasn't explained is that these CloudFront tunnels are basically infinitely scalable. So one tunnel actually can consist up to 25 connectors, each of them establishing four connectors to four different systems on two availability zones, each pushing one gigabit per second. That's one ton tunnel. One tunnel, 100 gigabits per second capacity. And on an account, you can have a thousand tunnels. So just for scale, if you ever had worry about bandwidth, you can forget about this problem right now. Okay. But why are these arrows pointing out? So the thing is, as it was also said, these are reverse tunnels that are established outbound, but traffic through them is bidirectional. And this enables something that zero trust and software defined perimeter as a deployment model called the black cloud. It's one of the biggest benefits connecting your whole network like this because it completely separates and isolates it from the public Internet. Okay. Let's continue. Something is missing here in the middle, and what is missing are all the security components. So now let's shortly define what do we actually need here if we look at the use cases on the left side. So let's look at the first three ones. Private customer, business customers, partners. All external entities, everybody actually consuming Swiss Post services over the public Internet, the partners, this kind of legacy side to side connections, VPNs, want to get rid of that. So everything should be Internet consumable. So for these use cases to work, so we can implement this, need capabilities something like distributed denial of service protection, we need a web application firewall, we need a reverse proxy, we need zero trust network access to enable that black cloud security posture, which is also delivery of policy based access control, we need DNS, public DNS, we need certificates, we need firewalls if we're doing public network based integration. So, kind of this left pillar is what completely solves all our use cases for the three first targets: private customers, partners and so on. What about the other three? Suppliers, employees, systems. So systems are kind of going both ways. It's mixed world, but suppliers, employees we are talking about access to critical internal information and applications, we're talking about managed devices, we're talking about work and functioning workplace and so on and so forth. So we need protect against malware, phishing, we need to inspect traffic in for policies and so on. So what we need are a completely different set of capabilities. So to protect that other column, basically what we need, we need a secure web gateway for malware protection, we need data loss prevention to stop data exfiltration, We also need zero trust network access because we want to complete that black cloud posture for all the use cases that we have. This is of course delivering us policy based access control. What we need is a cloud access security broker because we have hundreds of SaaS applications for which we need access control and data loss prevention. We need, of course, now internal DNS, we need internal certs, and we need remote browser isolation. Why do we need that? Because we want our suppliers to work from bring your own devices. Why do we need to give them a workplace device that has a life cycle, is attached to a price tag and licenses? You have an iPhone? You can use an iPhone. Here's a URL. So remote browser isolation simplifies workplace delivery and access. Okay. But here's the thing. This alone is not enough. As I said, zero trust at Swiss Post is a much, much broader term. So what is missing here? Now if we look at completely internal traffic, let's say we have a workload here that needs to talk to a workload here. How do we do that? Should we push it through all of this? Absolutely, we could, but it would be like dropping bombs on pigeons. It's not really necessary. So we are exchanging traffic from one deterministically controlled system to another deterministically controlled system. So, what we actually want is a very lean solution that just does resilient, ideally private interconnect connectivity, so we can exchange these workloads directly. So this is where our second component, second building block comes in play. Let's put it here. So we call that network as a service. What it does is basically connects all our campus location with all our back end systems like this. Now this immediately got confusing because I'm crossing some yellow some green and blue lines. What's happening here? So because we don't have so much time to explain, I will oversimplify everything, just think of it like this. We just demoted our green lines from our primary to our secondary fallback connectivity. So, if for whatever reason the blue lines fail, we can fail over to the green lines so that customers can still consume our workloads. This is not 100 correct, but for the sake of simplification let's say that it is. Now we are missing one last thing. While all the things on the right side have a green arrow, what happens with our campus locations? We have printers that need to access print server that are moving to SaaS services. We have different clients and everything. So there's one last error missing. That is this one. Basically, an interconnect between the green cloud and the blue cloud. So everything can go everywhere. But now the question is, why is this needed besides the reasons of resiliency? The reason why it's needed, because up here is the central and only point of Internet breakout. Why is it here? Basically, it's here because of this. Every piece of traffic that leaves the Swiss Post Network has to be submitted to inspection and policy to stop data exfiltration, data loss prevention, it needs to be scanned and approved, malware protection, everything that's coming in and everything that's coming out. So there you go. We have all the North South traffic covered, which would be the green part. We have all the East West traffic covered and the interconnect, the blue part. But we have another problem. While the green cloud delivers connectivity, enforcement, and access control, the blue cloud only delivers connectivity. So how do we do enforce policy and access control for internal systems talking to each other, never reaching the green cloud? We're missing one last component as part of our Zero Trust foundation, which basically enables us to do this. We have two workloads here that talk to each other. We want them to talk based on policy. We have a workload here, so they go down here. Another one there. All of this has to be policy and identity driven for internal systems talking to each other. This is this is how on every layer of this for internal, external traffic, we don't do connectivity, enforcement, and access control. So how does this happen? This happens, and I just noticed, I think the software update is what confused me, is that, of course, what the blue part does, it hierarchically normalizes our networks. So we can completely delete this part here, this back end interconnect. Forget it. It doesn't exist anymore. So the third building block that we need to enforce all this internal traffic is right here, and it's a micro segmentation system. It gets deployed of all these location and, of course, campus locations where we have workloads like sorting centers or anywhere that need east west boundary and control. The red cloud is basically the orchestrator that orchestrates a policy on software, so that means agents, and hardware level that means intelligent switches that micro tag the traffic and then can apply these orchestrator rules to control the internal traffic exchange. Last thing is I see we have another question mark. Maybe question for the audience. Where would you connect the subsidiaries? So they are acquirers, we suppose, but we don't really trust them. We want minimum loose, complicated data exchange collaboration, but that's it. So when we want to get rid of subsidiary, all we want to do is delete the policy. So where do we connect it? To the green or the blue part? I didn't hear. I will assume you said green because that's the correct answer. So here's the thing. The green part is at the same time an SD WAN provider as a blue part, but operating on different layers for different purposes. Okay? So these three components together is what we call zero trust foundation. Now let's map technology onto this. Let's start with the easy parts because we want to cover everything. This here is based on SD WAN. SD WAN is not a new technology. It's existed on the market for a long time. There are many vendors doing that. Since for Swiss Post, we don't want to be or we are not an infrastructure service provider for other companies. So, wasting here lots of resources, managing our own interconnects and network, honestly these resources can be spent better somewhere else. So what we want is a fully managed service. So this is something that is normally provided by an ISP who in turn develop their own solutions or use a third party partner solution that deploy and offer it as a fully managed service. So in Switzerland this would be Sunrise, Swisscom or anything like that. So it's basically commodity on the market that you simply need to analyse, define your requirements and choose whatever you need. Similar solution with this part. There are also several very established vendors in the market doing micro segmentation based on agent software or hardware. It is a relatively simple thing to evaluate. It's extremely tricky thing to deploy because you need to really understand your internal network architecture, your network address translation, overlapping IP ranges and everything or the solution you're deploying will not actually do anything. Okay. So the problem is with the green part. So we've heard SASE mentioned few times today. This is where you would normally map a SASE or an SSE service. But here's the problem. If you really look at SASE as a framework, you will relatively fast realize that scope of SASE is only this. It's a business to employee service, to an extent business to supplier if that's how your workplace works and so on. And this basically means that traditional SASE service solves only the right pillar of our problem here and delivers these capabilities. So if you ever spoke to a SaaS vendor where you're trying to evaluate something, you're being told that this thing will increase your automation, reduce your operation effort, it will simplify everything, it will be fully automated. And the thing is at the same time it's a truth and it's a lie. Yeah? Because basically it's solving half the problem. Everything in the left column needs further operation, needs people and know how and teams. So in the end when you deploy an operating, you realize that you're just adding complexity on top. It's license cost on top and it's complexity on top, new things that people have to learn and they still have to maintain half the solution for all this to function. So what Swiss Post wants and the only solution forward as a one unified platform that completely converges all the capabilities on the entire spectrum of the enterprise fulfilling all the use cases. Now the problem is that the solution like this doesn't exist. Or does it? We know it does. So this is Cloudflare. Why is this Cloudflare? We have to answer this. Swiss Post, it's a 100% government based company, owned company, so every decision like this we make needs to have extremely strong reasons why it was made. So why is this Cloudflare? We started this initiative almost three and a half years ago. We evaluated 14 different solutions, which means we went up and down on Gartner Magic Quadrant and Forrester Wave about three times. Out of these 14 solutions, we mapped four on a short list, and after a long RFI RFP requirement engineering process, we decided to proceed with Cloudflare into a POC. That proof of concept wasn't a normal three months and we're done. The proof of concept took over a year, went over several thousands of hours were invested into leaving no stone unturned. Looking at everything, implementing everything, testing everything, so that we could make an intelligent decision. And that decision at the end of this POC that Cloudflare is basically the only platform on the market that fully converges on all these capabilities, on all the use cases for the entire spectrum that Swiss Post needs to cover. And there you go. I would like to leave you with two points about scale. Actually, let's make that three points because, surprisingly, one important point nobody here mentioned. The moment I now mention it, you will realize, oh, I mean I mean, I expect are you ready? Doesn't this look like an unbelievable single point of failure? That's exactly the point. So let me put that into perspective. Swiss Post has today two data centers, two availability zones, everything is redundant, yeah? As we've learned today, Cloudflare works different. Most SASE providers deploy on top of hyperscalers. So you get your SASE solutions on two normally two availability zones for failover, a high availability. You can scale above that, but it mostly gets very expensive and very complicated very fast. Now the thing with Cloudflare is that they run on their own hardware in over these 300 locations across the globe, and every single capability that you'll see here listed in green is running and available on every single Cloudflare location. Combine that with Cloudflare being built on any cost network principles means that every single configuration, every service that we push here and deploy is instantly replicated across the globe. Of course, this is configurable for some reason, maybe we don't want our traffic to go to America or to Russia. So if we limit ourselves to a European Union only, we are still talking about sixty, seventy data centers only in The EU, which basically means that we are scaling our connectivity enforcement and access control layer from two to 300 availability zones. This simply an incredible increase in resiliency, performance, and delivery. Okay. Second point and about scale, and here let's shortly just discuss about longevity. So, Swiss Post has a strategy that is bound to a roadmap. What needs to happen? Where is the company going? What needs to be delivered by them? Some of these strategic points are mandated by the government, like you've all read changes into digital letters and being able to deliver every service digitally and not physically and so on and so forth. Behind that strategy is a vision. The vision doesn't have a roadmap, it's just a light beacon saying where is this company going? What do we want to achieve? Now Cloudflare has a strategy and Cloudflare has a vision. Where are they going with all of this? And the thing is that these two visions are so in sync that basically Swiss Post committed to this partnership with the longest contract we have ever signed with any cybersecurity vendor. Yeah? And the third point about scale, let's talk about volume. Maybe it's the most important point, because all of this would be nice, but not really relevant if Swiss Post would have committed to a volume of 50 Cloudflare seats falling under the Cloudflare free tier. A seat is, by the way, a known entity in the system. So the interesting question is what is the volume of a Swiss Post commitment? Yeah? Now this might surprise you, but the volume is basically every citizen of Switzerland. So every service that Swiss Pulse provides for partners, customers, end customer, businesses, employees, suppliers, absolutely everything will be rolled and protected by this service with all the benefits we discussed today, which means we are delivering Zero Trust on a nation scale and not only for a company. Now there are some notable exceptions to this that I have to mention or I will have an HR call tomorrow. We are still discussing Swiss Post financial services, which hasn't been decided which way this will go and what we will do with that. There are some services that are right now completely out of scope, like e voting for instance, is out of scope of this for compliance reasons, which are not really based on fact, but more of let's triple, quadruple check before we decide anything. So that's completely out of scope. So there are some exceptions like this. And, yeah, here we go. We arrived at the end. I have hit the awesomeness marker. It's red. I assume that's what it means. There we go. Hey, everyone. Martin again. I hope you all really enjoyed that presentation as much as I did and learned as much from I did learned as much from it as I did too. I'll close out the webinar really quickly by just sharing a few final thoughts about that single platform that Nicola was talking about. You know, our term for it, a Cloudflare, is a connectivity cloud. Ultimately, it doesn't really matter what you call it. You know, Swiss Post clearly has their own terminology. But what matters more is the fact that it is what it can do, which is to connect and secure and even build everything in your own digital environment, whether it's workforce facing, partner facing, customer facing, etcetera, from a single platform that runs globally. CloudFront Connectivity Cloud does that in part simply by combining a pretty unprecedented amount of security and app delivery and networking and developer services on that single platform. I won't read through every service that's listed here, but you should be able to see just at a glance that, you know, this platform is able to meet all of the increasingly interlinked and intertwined use cases that Nicola was talking about in his speech. But of course, just meeting just services checkboxes isn't enough. What's really important is the ability to handle all of the unique policy and compliance and architectural quirks that inevitably come up during network transformation and zero trust adoption, cloud migration, things like that. And Cloudflare delivers that by, well, in a few ways. One of them is by delivering all of our services from that single platform that is designed to be able to run everywhere in our network globally. And when we talk about globally, we we really wanna mean that. So, you know, making the platform available globally for better scale and resilience. Also, letting you easily customize both policy enforcement and actually where services run on, like, a geographical sense with custom code or even just in our dashboard. You know? So that means that being able to, you know, use that custom code to, you build some of your own Cloudflare functionality really easily, or being able to decide, hey, I only want certain types of traffic inspection or decryption, or my encryption keys to being stored in specific geographical locations, which is a common compliance need, something that Swiss Post, in fact, is doing a little bit as well with Cloudflare. And then finally, Cloudflare also lets you manage everything from a single UI or API, which becomes really important when you're running that many services from that single platform. Again, like I said, when I say global, we really do mean it. Right now, our network spans over three thirty cities and has around four fifty terabits per second of capacity and counting. That number is always going up. Both of them are always going up, in fact. So launch this space to see how else what other cities we expand to and how our network continues to grow. But when you think about achieving resiliency at the scale that Swiss Post needs to, or when you think about being able to ensure that certain things are only happening in certain geographical locations, this true global scale starts to become really important, being able to serve companies who are operating in any region under any conditions. And all of this leads to some really important outcomes, helping organizations boost team efficiency across both security and IT, reducing risk and even deprecating old services on the way that Nicola was talking about. And all of that leads to some really powerful and significant ROI. That's about it for me. Thanks again for listening. If you wanna hear more presentations like Nikola's, then please check out our upcoming event schedule, which is linked there on the left. And then if you wanna learn wanna learn more about the connectivity cloud platform, then check out the ebook that's linked on the right. Thanks so much and see you again soon.