The challenge
Abu Dhabi Airports Company operates Zayed International Airport and Al Bateen Executive Airport, serving millions of passengers annually. As a critical infrastructure operator, ADAC required a security posture that matched the sensitivity of its operations.
The existing architecture presented several risks:
- VPN dependencies for remote access. Employees and contractors accessed internal applications via VPN, creating broad network access and increased exposure if credentials were compromised.
- Inconsistent security across connectivity modes. Users at HQ, on VPN, and working from home had different security postures, with no unified policy enforcement.
- Broad network access instead of application-level control. The VPN granted network-level access rather than restricting users to the specific applications they needed.
- Third-party and vendor access. External contractors required access to internal applications, but VPN access expanded their reach beyond what they actually needed.
- Limited visibility. The security team lacked granular insight into user activity and access patterns.
What Brixio deployed
Three connectivity scenarios, one security model
ADAC defined three scenarios that needed consistent protection: employees working remotely from home, employees working remotely while connected to a VPN, and employees working on the ADAC network (HQ). Brixio designed and deployed a Cloudflare Zero Trust architecture that enforced consistent identity-based policies across all three.
Zero Trust Network Access (ZTNA)
- Replaced traditional VPN with Cloudflare Access for identity-based authentication.
- Role-based access controls (RBAC) so employees and contractors reach only the applications they need.
- MFA and SSO enforced for all users.
Secure Web Gateway (SWG) with WARP
- WARP client deployed on managed devices for encrypted, inspected traffic.
- DNS-level security policies enforced regardless of location.
- Split tunneling and local domain fallback configured for optimal traffic flow.
Application-level access control
- Granular application segmentation replacing broad network access.
- Policy-based access tied to user identity, role, and device posture.
- Third-party and vendor access scoped to specific applications, not the network.
Monitoring and audit
- Detailed access logs for monitoring and compliance.
- Security event visibility for ADAC's operations team.
Architecture
Three connectivity scenarios converge on a single Cloudflare Zero Trust enforcement plane.
Results
After rollout across both airports, the security model was unified across the three connectivity scenarios, and access was scoped at the application level for every user population.
