Reference infrastructure path

Public transit into the environment: carrier SIP, remote users, customer traffic and inbound mail.

• BGP / multi-WAN
• Carrier SIP trunks
• Cloudflare DNS
• Protective DNS Filtering
• SSL Certificates
• CDN

Security considerations

Exposed surface is enumerated and reduced. Authoritative DNS is locked and monitored, outbound resolution is filtered, and public services present valid, automatically renewed certificates.

Deployment considerations

Redundant circuits where availability requires it, with documented failover behaviour, TTL strategy and tested cutover.

Policy enforcement point between untrusted transit and internal service zones.

• pfSense / OPNsense
• Fortinet
• MikroTik
• Cloud security groups

Security considerations

Default-deny rule base, segmentation between voice, server and user zones, logging to a retained destination.

Deployment considerations

Rule bases are written from a service inventory and reviewed on change, not accumulated ad hoc.

Authenticated path for administrators, remote agents and site-to-site connectivity.

• WireGuard
• IPsec
• OpenVPN
• Zero-trust access

Security considerations

MFA on administrative access, per-role routing, short-lived credentials and revocation procedure.

Deployment considerations

Access design is mapped to roles before rollout; management interfaces are never published directly.

The service core: telephony, hypervisors, cloud workloads and business applications.

• Asterisk / FreePBX
• 3CX
• Issabel / Yeastar / VitalPBX
• RingCentral / CloudTalk / KrispCall
• ViciDial / manual / auto / predictive dialers
• VMware
• Proxmox
• Hyper-V
• Citrix Hypervisor
• Oracle VM VirtualBox
• AWS / Azure / GCP

Security considerations

Hardened baselines, TLS/SRTP for voice, patch cadence, isolated management network and least-privilege service accounts.

Deployment considerations

Sized against measured concurrency and workload profile, with capacity headroom and a documented scale path.

Corporate email, collaboration, line-of-business systems, public websites and customer-facing web applications.

• Microsoft 365
• Google Workspace
• Web / database tiers
• Website Design
• Custom Website Development
• WordPress Development
• React Development
• AI-Powered Websites
• E-Commerce Development
• Corporate Websites
• Landing Pages
• Custom Web Applications
• Website Redesign & Modernisation
• Website Maintenance & Support
• cPanel / WHM
• Plesk
• GoDaddy / IONOS / Hostinger
• Namecheap / Bluehost
• SPF
• DKIM
• DMARC
• MTA-STS
• TLS-RPT
• Email Security Gateway

Security considerations

Identity governance, conditional access, staged SPF/DKIM/DMARC enforcement with MTA-STS and TLS-RPT on top, gateway filtering inbound and outbound, and audited administrative roles.

Deployment considerations

Migrations run with a rehearsed cutover plan, coexistence window and defined rollback point; mail authentication moves to enforcement only once every sending source is inventoried. Websites and web applications are built from a documented component set, staged before launch, and handed over with backups, monitoring and an update path. AI features are integrations with third-party AI services, not proprietary models.

Workstations, laptops and servers where users open mail, browse and run business software — the layer most incidents actually start on.

• Kaspersky Business
• ESET Endpoint Security
• Bitdefender GravityZone
• CrowdStrike Falcon
• Check Point Harmony Endpoint
• Microsoft Defender for Endpoint
• Sophos Intercept X

Security considerations

Attack-surface reduction, application and device control, disk encryption and host isolation on detection.

Deployment considerations

Rules are piloted in audit mode per device group, then enforced once exceptions are known and documented.

Recovery capability and operational visibility across every layer above.

• Veeam Backup & Replication
• NAKIVO Backup & Replication
• Acronis Cyber Protect
• Commvault Cloud
• Wasabi
• Zabbix / Prometheus
• Log retention

Security considerations

Immutable and offsite copies, credentials separated from production, alerting on backup and restore failures.

Deployment considerations

Jobs derive from stated RPO/RTO targets and restores are tested on a defined schedule.