Demo library › Chapter 7
Only healthy devices reach sensitive apps
pgAdmin requires a device with its firewall on. Turn it off and access ends. Backlog's response time is measured from every device.
The problem
Rickie may use the database console, but not from a laptop with its firewall off. And when someone says Backlog is slow from home, the help desk has nothing to look at.
Lands with: security teams with a device standard, and IT help desks
Before you start
- Lab only.
- The client signed in as
, with admin rights on Windows to turn the firewall off and on.
Run it
The device is part of the policy
| Do | Say |
|---|---|
| Zero Trust → Team & Resources → Devices → Device posture: Windows firewall on, Windows 10 or later. | The client reports these from every device every few minutes. |
| Access controls → Policies → IT Admins only. | pgAdmin's policy requires the firewall check, as well as the IT Admins group. |
As Rickie, open https://pgadmin.corp.internal. | It works: the right person, on a healthy device. |
| Turn the Windows firewall off, wait for the next report (up to five minutes), and reload pgAdmin. | Refused. Same person and password, but the device has changed. Turn the firewall back on and access returns. |
Whybackground, if you are asked
The policy now checks who you are and what you are using. Same person, same password: only the device changed. Access returns on its own once the firewall is back on.
The experience, measured
| Do | Say |
|---|---|
| Insights → Digital experience → Tests → Backlog reachability. | Every device checks Backlog every ten minutes, so the help desk can see when it is slow. |
Whybackground, if you are asked
When someone says Backlog is slow from home, the help desk opens this instead of asking them to run a speed test.
What the audience should see
- pgAdmin opens, is refused with the firewall off, then opens again.
- DEX results for Backlog per device.
Where the evidence is
Access authentication logs: the refused request, naming the failed check.
Known limitations
- Posture is checked on the client's schedule, so the refusal is not instant.
- Only built-in checks. Third-party ones such as CrowdStrike need those products.
Part of: Replace the VPN · The full tour