⚡ Direct Answer Summary (AI Overview / Key Takeaway)
Technical architecture proving logical, identity, and cryptographic separation across client tenants in the ThreatKrusher ecosystem.
eTrepid MSSP Multi-Tenant Separation & Isolation Architecture
Governing Standard: NIST SP 800-171 3.13 / FedRAMP Multi-Tenancy Controls
1. Architectural Principle
As a Managed Security Service Provider managing multiple defense and commercial enterprises, eTrepid Inc. enforces strict, cryptographic, logical, and administrative multi-tenant separation. Customer data, network traffic, encryption keys, and administrative credentials never cross customer tenant boundaries.
2. Multi-Tenant Isolation Layers
flowchart TD
subgraph Management ["eTrepid Central Management Plane"]
RMM["ThreatKrusher ITSM Telemetry Engine"]
SOC["ThreatKrusher SOC Telemetry Collector"]
end
subgraph ClientA ["Customer A Tenant (Isolated)"]
CA_ID["Entra ID Tenant A"]
CA_DATA["CUI Enclave Storage A"]
end
subgraph ClientB ["Customer B Tenant (Isolated)"]
CB_ID["Entra ID Tenant B"]
CB_DATA["CUI Enclave Storage B"]
end
Management == Cryptographically Isolated Sessions ==> ClientA
Management == Cryptographically Isolated Sessions ==> ClientB
ClientA <-. STRICT ISOLATION (NO INTER-TENANT ROUTING) .-> ClientB
2.1 Cloud Enclave & Identity Segregation
Dedicated Microsoft Entra ID Tenants: Each client operates within its own dedicated cloud tenant (Commercial, GCC, or GCC High). eTrepid does not co-mingle customer users in shared multi-tenant directories.
Role-Based Tenant Access: eTrepid engineers access customer environments using dedicated, audited admin credentials with Just-In-Time (JIT) access and multi-factor authentication.
2.2 Network & ZTNA Isolation
ThreatKrusher Trust implements micro-segmentation and Zero Trust Network Access (ZTNA) brokers, preventing lateral movement between different client customer networks.
Inter-client network routing is architecturally prohibited at the network fabric layer.
2.3 Cryptographic Separation
All data stored within customer enclaves is encrypted using customer-specific encryption keys. eTrepid does not use master encryption keys spanning across multiple customer accounts.
