Network and gateway security is sometimes dismissed as legacy thinking in a cloud-first, identity-driven world. That is a mistake. For Australian government, well-designed gateways and segmented networks remain a core line of defence, and they are explicitly addressed throughout the Information Security Manual (ISM). The goal is not to choose between perimeter and identity controls but to layer them so that a single failure does not become a catastrophe.
Why gateways still matter
A gateway is the controlled boundary between an agency’s environment and untrusted networks, principally the internet. Its job is to ensure connectivity is inspected, filtered, logged and policy-enforced rather than open and unmonitored. Even as workloads move to the cloud, traffic still flows to and from those services, and email, web browsing and remote access remain primary attack vectors that gateways are well placed to control.
The federal government has long pursued gateway consolidation, reducing the number of internet entry points agencies operate. The security logic is straightforward: fewer gateways mean fewer places to defend, monitor and patch, and a more consistent application of inspection and filtering controls. Whether you run your own gateway or consume a gateway service, the principle holds: concentrate and control your internet boundary rather than letting connectivity sprawl.
Core gateway controls
Effective gateways do more than block traffic on ports. A mature government gateway typically provides:
- Content inspection and filtering of web and email traffic, including malware scanning and category-based web filtering.
- TLS inspection where appropriate, so encrypted traffic is not a blind spot, balanced against privacy and legal considerations.
- Data loss prevention to detect and stop sensitive or classified information leaving the network inappropriately.
- Email security controls including SPF, DKIM and DMARC to reduce spoofing and phishing, plus sandboxing of attachments.
- Comprehensive logging feeding a central monitoring capability so that gateway events contribute to threat detection and incident investigation.
Email deserves particular attention. Phishing remains one of the most common initial access methods, and gateway-level filtering combined with user awareness substantially reduces exposure. Pair this with application controls from the Essential Eight on endpoints, and you address both the network and host sides of the same threat.
Segmentation: contain the blast radius
If an attacker gets in, segmentation determines how far they can go. A flat network where every device can reach every other device turns a single compromised laptop into a foothold across the entire organisation. Segmentation divides the network into zones with controlled, monitored traffic between them.
Sensible zones for a government agency include:
- Corporate user environment for staff workstations and productivity tools.
- Server and application tiers separated from user networks, with strict access controls.
- Management network for administrative access to infrastructure, isolated and tightly restricted.
- Guest and untrusted networks kept entirely separate from corporate systems.
- Operational technology where present, isolated from corporate IT with carefully controlled crossing points.
Within zones, microsegmentation can further restrict lateral movement, allowing only the specific flows applications genuinely need. This is the network expression of least privilege, and it is one of the highest-value investments an agency can make against ransomware, which depends heavily on lateral movement to spread.
Adopting zero trust without abandoning the perimeter
Zero trust assumes no implicit trust based on network location. Every request is verified using identity, device posture and context before access is granted, and access is scoped to what is needed. For government, this matters because remote work, cloud services and mobile devices mean users and data routinely sit outside any office network.
The key insight is that zero trust complements gateways and segmentation rather than replacing them. Identity-aware access controls handle the question of who and what can connect; gateways and segmentation handle where traffic can flow and ensure it is inspected. The strongest architectures combine both. Practical first steps toward zero trust include enforcing phishing-resistant multi-factor authentication everywhere, verifying device health before granting access, and moving from broad network access to per-application access brokered by identity.
Remote access done properly
Remote access is a recurring weak point. Legacy VPNs that drop users onto a flat internal network undermine segmentation entirely. Where remote access is needed:
- Require multi-factor authentication for all remote sessions.
- Check device posture before granting access, not just user credentials.
- Grant access to specific applications rather than the whole network.
- Log all remote sessions and feed them into monitoring.
- Patch remote access infrastructure aggressively, as it is a favourite target.
Securing east-west and cloud traffic
Most early gateway thinking concentrated on north-south traffic, the flow between the agency and the internet. The harder problem today is east-west traffic, the lateral movement between internal systems, and the new flows between on-premises networks and cloud services. Attackers who breach the perimeter spend the bulk of their effort moving sideways toward valuable targets, and that movement is exactly what flat networks fail to constrain.
Two shifts help here. First, extend inspection and policy enforcement to internal and cloud-bound traffic, not just the internet boundary, so that lateral connections are subject to the same scrutiny as outbound browsing. Second, recognise that the gateway function increasingly lives in the cloud as well as on-premises. As agencies adopt secure service edge architectures, inspection, filtering and access brokering can be delivered closer to the user wherever they are working, rather than backhauling all traffic through a central data centre. The principle is unchanged, concentrate and inspect connectivity, but the implementation moves to match a distributed workforce and cloud-hosted applications.
When integrating cloud, treat the connections between your network and cloud platforms as first-class boundaries. Private connectivity, restricted egress, and inspection of cloud-bound flows prevent a compromised cloud workload from becoming a quiet pivot back into the corporate environment, and vice versa.
Monitoring and detection tie it together
Controls you cannot observe are controls you cannot trust. Gateway logs, segmentation policy hits, authentication events and endpoint telemetry should flow into a central monitoring capability where they can be correlated. The objective is to detect the patterns of an intrusion, such as unusual outbound connections, lateral movement attempts or anomalous administrative activity, quickly enough to respond before damage is done. Define what normal looks like for your environment so anomalies stand out, and rehearse your response so that detection actually leads to action.
Don’t forget DNS, certificates and the basics
Sophisticated architecture counts for little if foundational network services are neglected. Several unglamorous areas cause a disproportionate share of incidents and deserve explicit attention:
- DNS security. DNS is both a control point and an attack surface. Protective DNS filtering can block connections to known malicious domains before any payload is delivered, while DNS logging often reveals compromised hosts beaconing out to command-and-control infrastructure.
- Certificate and key management. Expired or poorly managed certificates cause outages and erode trust, and orphaned keys are a quiet risk. Maintain an inventory and automate renewal where you can.
- Network device hardening. Routers, switches, firewalls and wireless controllers are themselves targets. Change default credentials, patch firmware, restrict management access to the management network, and disable unused services.
- Wireless security. Corporate, guest and operational wireless must be properly separated, with strong authentication on corporate networks and full isolation of guest access from internal systems.
These basics are unglamorous precisely because they are assumed to be handled, which is exactly why attackers find them unaddressed. A periodic review of foundational network services often uncovers more real risk than a new product purchase.
Aligning to the ISM and governing the architecture
The ISM provides risk-based controls across gateways, network design, cryptography and monitoring. Rather than treating it as a checklist, map your network architecture to the relevant controls, document where you have accepted residual risk, and revisit those decisions as the environment and threat landscape change. Network architecture decisions made years ago are often quietly undermined by new cloud connections, shadow IT and convenience exceptions, so periodic review is essential.
This is where ongoing security leadership earns its keep. A virtual CISO can own the network security strategy, ensure new projects respect segmentation and zero trust principles, and keep the architecture aligned with the ISM as it evolves. CISO Advisory supports government and council clients with gateway and network design reviews, segmentation strategy and zero trust roadmaps. To discuss your environment, call 07 2112 8502 or reach us through our contact page.
The bottom line
Gateways and network security are not relics of a pre-cloud era; they are layers that, combined with identity-centric zero trust, give government the depth of defence it needs. Consolidate and control your internet boundary, segment ruthlessly to contain compromise, verify every access request, and watch everything. Done well, this architecture means a single mistake does not become a headline.
Frequently asked questions
What is a secure internet gateway?
A secure internet gateway is a controlled boundary between an agency network and the public internet. It concentrates inbound and outbound traffic through inspection, filtering, logging and threat-detection controls so that connectivity is monitored and policy-enforced rather than open. Consolidating gateways reduces the number of points an agency must defend and monitor.
Is the network perimeter still relevant with cloud and remote work?
Yes, but it has changed. The traditional hard perimeter is now one layer among many. Agencies still need gateway controls, but they must combine them with identity-centric controls, device health checks and segmentation, since users, data and applications increasingly sit outside the office network.
What is network segmentation?
Segmentation divides a network into zones with controlled traffic between them, so a compromise in one area cannot spread freely. For government, segmenting corporate, operational, guest and management networks limits the blast radius of an intrusion and supports the least-privilege principle at the network layer.
What is zero trust?
Zero trust is a model that assumes no user, device or connection is trusted by default, even inside the network. Every access request is verified using identity, device posture and context before access is granted, and access is limited to what is needed. It complements, rather than replaces, gateway and segmentation controls.
How does the ISM apply to network security?
The Information Security Manual provides risk-based controls covering gateways, network design, segmentation, cryptography and monitoring. Agencies select and apply these controls according to the sensitivity of the data and the consequences of compromise, documenting their choices as part of the system's authorisation to operate.
Need this handled for your organisation?
Confidential and no obligation. We respond the same business day — on-site same day / next business day, or remote, Australia-wide. Prefer to talk now? Call us 24/7 on 07 2112 8502.