Demo library › Chapter 4
Contractor access without a company laptop
A contractor signs in from her own machine, with no client, and uses the wiki in a remote browser with copy, paste, download and print turned off.
The problem
Ramona Flatley is a contractor and needs the wiki. Shipping her a laptop is slow and expensive, and letting her own machine onto the network is worse. Whatever she can read, she can also copy and keep.
Lands with: IT and security teams who onboard third parties
Before you start
- A browser without the Cloudflare One client, in a private window.
- Ramona's sign-in:
, passwordSavetheinternet!1.
Run it
A policy for contractors
| Do | Say |
|---|---|
| Zero Trust → Access controls → Applications → the wiki's application → policies. | Two policies: employees, and Contractors (isolated). The Contractors group comes from the identity provider, and contractors only get in through a remote browser. |
| As Ramona, open Nexus. | She signs in and the wiki loads. It runs in a browser on Cloudflare's network, so nothing reaches her machine. |
| Try to copy some text, then print or download a page. | None of it works. The Gateway rule Contractors: read-only wiki in isolation turns those off for contractors. Employees are unaffected. |
| As Ramona, open WorkWeek. | Refused. She was given the wiki and nothing else. |
Whybackground, if you are asked
Shipping a contractor a managed laptop is slow and expensive, and letting a personal machine onto the network is worse. In a remote browser nothing runs on her machine, there is no network access, and nothing is left behind when she closes the tab.
Ramona is a contractor because the identity provider says so: the Contractors group comes from HR's employment type. Upload is turned off too, alongside copy, paste, download and print.
What the audience should see
- The wiki working in Ramona's browser with no client installed.
- Copy, download and print refused.
- WorkWeek refused.
Where the evidence is
Access authentication logs: Ramona allowed by Contractors (isolated). Gateway HTTP logs: her wiki requests with the Isolate action.
Known limitations
- Ramona has an account in the company identity provider. A contractor with no account would sign in with a one-time PIN, which is not set up here.
- Needs Browser Isolation on the account.
Part of: Secure web gateway and data protection · The full tour