A government laptop in a majlis, a tablet on hotel wifi and a personal phone reading official mail are now ordinary parts of public sector work in the UAE, and none of them sit behind the network boundary the original security architecture assumed. Most entities responded by extending the VPN and calling it remote work security, which moves the perimeter rather than removing the assumption behind it. Properly designed hybrid work security frameworks do something different: they make every access decision on the evidence available at that moment, regardless of where the device is sitting. This article sets out how to build one for a government estate, what each control layer is for, and the evidence an auditor will ask you to produce. Our practical starting guide to zero trust covers the foundations.

Key Takeaways

• A VPN extends the trusted network to the endpoint. Zero trust removes the trusted network entirely, which is why replacing one with the other is an architecture change rather than a product swap.
• Device posture is the control that carries the most weight in a hybrid estate, because it is the only signal that describes the machine rather than the person holding it.
• Classification has to reach the document rather than the location, since a file that leaves the building carries its own controls or none at all.

Why the Perimeter Model Fails for Government Estates

The perimeter model made a single assumption: that being inside the network was itself evidence of legitimacy. Everything else followed from it. Once a device connected, it could reach broad ranges of internal services, and controls concentrated at the boundary because that was where the decision was made.

Hybrid work breaks the assumption without removing the architecture that depends on it. A laptop connected over a VPN from a residential connection is, as far as every internal system is concerned, inside. It reaches the same services with the same broad permissions, while sitting on a network the entity does not control, next to devices it cannot see, possibly with a family member's machine already compromised on the same segment.

Government estates feel this more sharply than commercial ones for two reasons. Their data classification obligations are stricter, so the consequence of a single compromised endpoint is larger. And their user population is more varied, spanning field inspectors, contact centre staff, policy officers and senior officials who each need very different access from very different places.

The response is not to restrict hybrid work, which is now a service delivery requirement rather than a convenience. It is to stop treating network location as evidence. Modern hybrid work security frameworks replace the single boundary decision with a per-request decision that considers identity, device state, data sensitivity and behaviour together.

The reference architecture for this is well established. NIST SP 800-207 defines the components and the logic, and most entities find that mapping their existing tooling onto that model reveals which of the required decision points they already own and which are missing.

Identity as the First Decision Point

Every access request starts with identity, and in a hybrid estate identity has to carry more weight than it did when the network provided a second opinion. That means phishing-resistant authentication for privileged roles, conditional policies that consider the device and the session rather than only the credential, and continuous evaluation so that a session revoked at ten o'clock does not remain valid until it expires at six.

Multi-factor authentication is necessary and no longer sufficient on its own. Attackers have industrialised session token theft and consent phishing, both of which succeed against an account that completed a valid second factor. Our note on why identity controls cannot rely on MFA alone covers the specific techniques and what defeats them.

Privileged access needs a separate path entirely. Administrative work should happen from managed workstations with elevated posture requirements, through a brokered session that records what was done, with credentials that exist only for the duration of the task. Extending ordinary hybrid access to administrators is the single most common design error in government estates.

Joiner, mover and leaver processes carry disproportionate weight in the public sector because secondments, temporary assignments and contractor engagements are frequent. Access that follows a person into a new role without shedding the old permissions accumulates into exactly the standing privilege that a zero trust design is meant to eliminate.

Federation with other entities adds its own considerations. Where staff from one authority access services provided by another, the trust relationship needs explicit terms covering authentication strength, device requirements and revocation, rather than an implicit assumption that the partner's controls match yours.

Device Posture: The Control That Does the Most Work

In a hybrid estate, device posture is the signal that distinguishes a legitimate session from a stolen credential used from an unknown machine. Posture means the specific, verifiable state of the endpoint at the moment of the request: enrolled in management, disk encrypted, operating system within a supported patch band, endpoint detection agent running and reporting, screen lock enforced, and no jailbreak or root indicators.

The critical design decision is what happens when posture fails. Blocking outright is the safest answer and the one users route around, usually by using a personal device instead. A graduated response works better: full access at healthy posture, read-only web access at degraded posture, and a self-service remediation path that tells the user exactly what to fix. Access is restored automatically once posture recovers.

Unmanaged and personally owned devices need a defined lane rather than a prohibition that everyone ignores. Browser-based access with no local download, no clipboard export and no offline cache lets a policy officer read a document on a personal tablet without that document ever landing on unmanaged storage. Published device security guidance such as the NCSC device security collection gives platform-specific baselines worth adopting rather than reinventing.

Posture signals must be fresh to be meaningful. A compliance check performed at enrolment and cached for thirty days tells you what the device looked like a month ago. Continuous evaluation, with a maximum signal age measured in hours, is what makes posture a live control rather than a record.

Data Handling Once the File Leaves the Building

Network controls stop working the moment a document is downloaded. From that point the only protections that travel with the file are the ones attached to it, which is why classification and rights management move from nice-to-have to load-bearing in a hybrid design.

Practical classification needs to be simple enough that staff apply it correctly under time pressure. Three or four tiers, applied at creation with a sensible default, backed by automatic detection for recognisable content such as identity numbers and financial records. Elaborate taxonomies produce inconsistent labelling, and inconsistent labels are worse than none because they create false confidence.

Rights management then enforces what each label permits: which groups can open the file, whether it can be printed or forwarded, and whether access expires. Because enforcement travels inside the document, it continues to apply on a personal laptop, in a personal mail account or on a USB drive, which is precisely the scenario network controls cannot address.

Collaboration platforms need explicit external sharing rules rather than defaults. Government entities routinely share documents with consultants, contractors and other authorities, and the sharing configuration in the productivity suite is where most accidental exposure originates. Reference configurations such as the published policy and configuration baselines for enterprise productivity suites are a reasonable starting point to adapt.

Monitoring should follow the data rather than the device. Alerts on bulk download, on classified content moving to unmanaged storage and on sharing links created for external addresses catch the realistic failure modes in a hybrid estate far more reliably than endpoint-only telemetry.

Network Access Without a Network Boundary

Replacing the VPN is usually the most visible part of the programme and it should be the last part, not the first. Identity, posture and data controls have to be working before removing the network boundary is safe, because the VPN is currently compensating for their absence.

The replacement pattern is application-level brokering. A user requests a specific application, the broker evaluates identity, posture and policy, and then connects that session to that application only. The user never receives a network route, which removes lateral movement as a capability rather than as a detection problem.

Migration works best application by application, starting with the ones that are already web-delivered and have clean authentication. Each migration removes a category of VPN user, and the VPN shrinks toward the small set of legacy systems that genuinely require network-level access and can then be isolated behind their own controls.

Private and legacy applications need a plan rather than an exception. Connector-based publishing can front most internal web applications without changing them, and thick-client applications can often be delivered through a published desktop session. What should not happen is a permanent VPN kept alive for a handful of systems nobody has scheduled to address.

Our note on protecting hybrid teams with zero trust services covers the operational side of running this model day to day.

Sequencing, Evidence and What Auditors Ask For

A workable sequence for a government entity runs in four phases. Phase one hardens identity: phishing-resistant factors for privileged roles, conditional access policies, continuous session evaluation. Phase two establishes device posture and the graduated access response. Phase three implements classification and rights management. Phase four migrates applications off the VPN.

Each phase should produce evidence, because that is what a review will ask for. Enrolment and compliance rates by device class. Conditional access policy inventory with the conditions each one evaluates. Classification coverage across document stores. Application migration status against the VPN user population. These four reports answer most of the questions an auditor will raise.

Expect the questions to focus on exceptions rather than on the design. Which users are exempt from posture requirements and why. How many devices are unmanaged and what they can reach. Which applications still require network-level access. Exceptions are acceptable when they are enumerated, owned and time-bound; they become findings when they are discovered during the review itself.

User experience deserves deliberate attention throughout. Hybrid work security frameworks that make legitimate work harder generate workarounds faster than they generate compliance, and in a public sector context those workarounds usually involve personal devices and personal accounts. Every control in the design should be tested against the question of what a busy officer will do when it fires at an inconvenient moment.

If you are planning this programme or partway through it, our team can review your current architecture against the model and identify which decision points are missing. You can also see how our security practice supports government estates across identity, endpoint and data controls.