Solution
Outsiders in, without devices, VPN accounts or exposure.
A contractor should reach the two applications in their statement of work and nothing else, on the device they already have, with controls on what leaves the page and a record of every launch. ZERA does that in a browser.
Before and after
What changes
Today
- Shipping laptops, or opening the VPN to unmanaged devices
- Accounts in a second portal that nobody offboards
- No control over copy, print or screenshots on the contractor's device
- No record of what the contractor actually opened
With Inlinea
- Their own device, any browser, nothing installed
- One Workspace, one identity, visibility per group
- Browser Security: attested browser, watermark, clipboard and capture controls
- Every launch in the ZERA Access Log; privileged work recorded as Session Evidence
What solves it
The capabilities behind it
- ZERA and the WorkspaceThe contractor's catalogue is the Contractors group's catalogue: two cards, no more.
- Browser SecurityAdmission for attested browsers; in-page controls and a watermark on sensitive applications.
- Session EvidenceWhen the contractor needs a server, the session is recorded and replayable.
- Sign out everywhereWhen the engagement ends, one action ends every session they hold.
A scenario
How a day goes
- 1Day oneThe contractor receives a Workspace address and signs in with the identity your organisation chose. The Contractors group shows the project tracker and the support desk.
- 2A sensitive taskThe data application requires an attested browser. The contractor installs the extension, an administrator approves it, and the page opens with a watermark and copy blocked.
- 3A server to fixThe build server card opens an SSH session in a tab with a managed credential; the session is recorded.
- 4Last dayDisable the account in your directory, or sign them out everywhere from Live Sessions. The logs stay.
Questions buyers ask
Do contractors need an account in our identity provider?
Not necessarily. Use your identity provider for staff and Inlinea's built-in identity, or a partner's provider, for outsiders. Groups and rules are the same either way.
Can we stop them taking data out?
Server-side admission is the control; in-page clipboard, print, capture and watermark controls are containment with an audit trail, and we say so plainly.