Moving a private bank to Azure, securely.

The situation

A Swiss private bank was moving from on-premises infrastructure to Azure. The security work spanned the destination environment and the protections that needed to carry through the move: cloud foundations, data loss prevention, endpoint detection and encryption.

The decision

I approached the migration as a connected architecture problem. Landing zones and security baselines establish the foundation, while data and endpoint controls address how information is used. Considering those layers together keeps the protection objective visible as the underlying infrastructure changes.

Making it work

The architecture covered Azure landing zones and baselines, the migration of data loss prevention to Microsoft Purview, Microsoft Defender endpoint detection and response, and BitLocker across the endpoint estate. The work connected cloud configuration with the controls protecting data and devices.

The result

The engagement provided security architecture across the on-premises-to-Azure migration. Its scope connected the cloud foundation, DLP migration, endpoint detection and encryption in one view of how the bank’s information would be protected through the change.

What I took forward

Migration changes where a control operates, but the reason for the control should remain clear. Starting with that reason helps a team distinguish what must be preserved from what can be improved in the new environment. It also keeps the architecture understandable beyond a list of cloud services.