Customer 360 Enterprise Data Platform — Denodo on Azure  ·  View 34 of 39  ·  Assurance

Trust Zones

Where the boundaries are, what crosses each one, and where an attacker actually arrives.

Editable source SVG draw.io All views
Internet — untrusted Browser and mobile Credential stuffing Scripted extraction Perimeter — Azure edge Front Door and WAF TLS 1.3, OWASP set API Management JWT, quota, schema DDoS Protection Application — private virtual network VDP pods no public address Data Catalog Design Studio named users only Solution Manager Data — reachable by private endpoint only Cache database ECID Crosswalk ADLS Gen2 CMK encrypted Databricks no public workspace Control — separate subscription, separate administrators Key Vault HSM-backed keys Microsoft Entra ID conditional access Microsoft Sentinel write-once sink Audit archive 13 months, immutable TLS 1.3, WAF blocked bearer, mTLS Private Link managed identity audit Trust Zones — What Crosses Each Boundary, and What Proves It May External / third party Risk / gap Interface / broker Security / platform Application we own Data store synchronous failure / alternate event / async No secret is held by a consumer and none by a pod. Every credential is fetched at runtime under a managed identity, and the audit path is one-directional by design. v 1.0 · owner Data & AI Global Practice · date 2026-09

Decisions

  • No secret is held by a consumer and none by a pod. Every source credential is fetched at runtime under a managed identity with a short lease.
  • Every data store is reachable by private endpoint only. There is no path from the application zone to a public data plane endpoint, so a compromised pod cannot exfiltrate over the internet.
  • The control zone is a separate subscription with separate administrators, and the audit path into it is one-directional. A platform operator cannot alter the record of what they did.

Where an attacker arrives

  • Credential stuffing against the consumer applications, stopped at token validation rather than at the network edge.
  • Scripted extraction by a legitimate but over-entitled user — the case the gateway cannot see. It is contained by row limits, quota and the usage telemetry on view 31, and it remains the most realistic breach path.

Encryption

  • TLS 1.3 in transit everywhere including source connections; customer-managed keys on ADLS and the cache database; audit archive immutable for 13 months.
◀  Cost Model All views Identity and Access  ▶
Solution Architecture v1.0 · Data & AI Global Practice · 2026-09 · 39 views · Denodo Platform, Microsoft Azure and open source34-security-zones