Zero Trust "Black Cloud" Overlay

Principal workflows

• Onboard an application: Each application is moved behind the overlay in a planned sequence: Moraph places App Connectors next to it, defines it as a segment, and writes the access policy your application owner approves.
• Grant and review access: Zscaler evaluates each connection against the user's identity, group and device posture before brokering it to one application. Moraph keeps the policies aligned to the groups your identity team manages and runs periodic access reviews.
• Monitor and respond: Connector health, policy denials and unusual access are streamed to your SIEM and watched by Moraph's operations team, who triage alerts and hand confirmed incidents to your security operations team.
• Change and evidence: Every change to segments, policies or connectors goes through your change process against an approved configuration baseline, and the resulting records feed your authorization package and continuous monitoring.

Who uses it

• Defense and intelligence program offices moving applications to zero trust access
• Information system security managers and officers responsible for authorization evidence
• Network and security operations teams who run remote and site access today
• Mission application owners who need their systems reachable only by the people who use them
• Assessors and inspectors who review access controls and logs

Reporting

• Applications onboarded, in progress and remaining
• Access decisions and denials by application and group
• Connector health and capacity by environment
• Changes requested, approved and applied against the baseline
• Access review status by application owner
• Alerts triaged and escalated, with outcomes

Features

• Applications hidden from the internet: Zscaler App Connectors make outbound connections to the Zscaler cloud, so protected applications need no inbound ports or public addresses.
• Per-application access: Zscaler brokers each user to the specific applications their policy allows, rather than placing them on a network segment.
• Identity-based policy: Access policies are written around groups from your identity provider, with Moraph keeping the mapping current as groups change.
• Device posture checks: Policies can require device conditions such as a managed certificate or an approved client before access is granted.
• Private Service Edge: Where your policy requires brokering inside your own environment, Moraph deploys and runs Zscaler Private Service Edges there.
• Segmentation design: Moraph groups applications into segments by mission, sensitivity and user population, documented for your assessors.
• Configuration baseline: An approved baseline of segments, policies and settings, compared against the live configuration on a schedule with differences reported.
• Log streaming to your SIEM: Access and connector logs are streamed to the security information and event management system you already run.
• Alert triage: Moraph's operations team watches connector health and unusual access and hands confirmed issues to your security team with the evidence.
• Change control: Every policy and connector change is raised, approved through your process, applied and recorded against the baseline.
• Access reviews: Lists of who can reach each application, prepared for application owners to certify, with removals tracked through to completion.
• Authorization evidence: Control mappings, configuration records and logs packaged to support your organization's own authorization and continuous monitoring.

Integrations

• Identity provider: Users authenticate through your identity provider using SAML, with group membership supplied for policy decisions, including where your identity provider supports PKI and CAC-based sign-in.
• User provisioning: Users and groups synchronized from your directory through SCIM where your identity provider supports it.
• SIEM: Zscaler log streaming sends access and connector events to your SIEM for correlation and retention under your policy.
• Endpoint management: Device posture checks draw on the certificates and client settings your endpoint management tool deploys.
• IT service management: Change requests, incidents and service requests are raised and tracked in your service management tool, or in Moraph's if you have none.
• Network and firewall teams: After each application is onboarded, your network team removes the inbound rules and public addresses it no longer needs, with Moraph supplying the list.
• Compliance tooling: Control mappings and evidence exported for your GRC or authorization tool.

Deployment

• Zscaler cloud with US-hosted management: Zscaler's government cloud offering where your requirements call for it, with Moraph's service tooling hosted in the United States region.
• Private Service Edge in your environment: Brokering placed inside your data centers or enclaves where your policy requires traffic to stay within them.
• Disconnected or classified environments: Where operations take place on classified networks, they are carried out under your organization's authority and procedures, by cleared staff, scoped in the proposal.

Security and privacy

• Single sign-on: Administrators and users sign in through your identity provider, so your authentication and multi-factor policies apply.
• Least-privilege administration: Moraph administrators hold role-based rights in the Zscaler admin portal limited to the tasks in the service scope.
• Cleared US support staff: Tickets for federal and defense clients are handled only by US citizens with active clearances.
• Complete audit trail: Every administrative change and access decision is logged with the person and time and kept under your retention policy.
• US hosting for government: Moraph's service tooling for US government clients is hosted in the United States region only.
• People decide: Where automation suggests a policy change or flags an anomaly, a named person reviews it; nothing is applied without approval.

Limitations

• Moraph is not Zscaler. Zscaler owns and operates the platform, and its own service commitments, roadmap and outages apply.
• Licenses are subject to Zscaler's terms, which are passed through to your organization.
• Moraph does not authorize your systems. Your authorizing official makes that decision; Moraph maps controls and supplies evidence to support it.
• Hiding an application reduces its exposure but does not fix vulnerabilities inside it. Patching and hardening of the applications remain with their owners.
• Some applications, such as those that depend on server-initiated connections to clients, may need redesign or another access method; these are identified during discovery.
• Removing old firewall rules and public addresses is carried out by your network team; Moraph identifies them but does not change networks outside the service scope.
• Who is entitled to which application is your decision. Moraph configures and reviews policies but does not grant access on its own judgment.
• The service does not replace your security operations center; it supplies alerts and evidence to it.

Next steps

Book a demonstration or a technical briefing at www.moraph.com/solutions/zero-trust-black-cloud-overlay. Purchasing routes and company information: www.moraph.com/how-to-buy.