Move the administration of your network to zero trust.
Shared admin passwords, direct SSH from any laptop, broad rights nobody reviews: the administration of network devices is often the last place where trust is implicit. ConnectMyAssets is zero trust ready. Every action is verified against who you are and what your role allows on that site and that subnet, every session goes through one recorded access path, credentials never reach the engineer, and everything is traced. On your own infrastructure.
Never trust, always verify: rights checked on every request
Least privilege by site and by subnet
No shared password: credentials stay in the Vault
One administration path, every session recorded
SSO OIDC and LDAP, MFA through your identity provider
Full audit trail, on your own infrastructure
One access path to your devices, recorded, with risky commands flagged.
USE CASES
Zero trust, applied to the network
Retire shared admin passwords
Device credentials live in the Vault. The bastion, scripts and collection use them on the server side, and the engineer never sees them: when someone leaves, there is no password to change everywhere.
Give contractors a scoped access
A contractor working on one site gets a role on that site only: they see its devices and subnets, open recorded sessions there, and nothing else exists for them, not even in counts.
Make every intervention provable
Who connected, to which device, when, with which credential, what was typed and what the device answered: the recording and the audit trail answer an auditor or an incident review in minutes.
Close the direct SSH paths
Once every administration goes through ConnectMyAssets, you can restrict the SSH access of your devices to the address of ConnectMyAssets: one controlled entry point instead of every laptop.
COMPARISON
From implicit trust to verified access
Network administration as it often is
Admin passwords shared in a file or a password manager
SSH straight from laptops to every device
Broad rights granted once and never reviewed
No record of what was typed on a device
Contractors with the same access as the team
With ConnectMyAssets
Credentials kept in the Vault, never shown to the engineer
One access path: the bastion, recorded and replayable
Rights by site and subnet, checked on every request
Every command captured, risky ones flagged
A contractor sees only the perimeter you grant
CAPABILITIES
The building blocks of zero trust administration
Identity, least privilege, a single access path, secrets out of reach and full traceability, built into the platform that already runs your network.
01
Verify every request
Rights are evaluated in the database on every request, before any list, count or export. A right you remove no longer works from the next action, without waiting for a session to expire.
02
Least privilege by site and subnet
Roles are granted on asset groups and descend, never climb. Every address belongs to the subnet of one group: an engineer of Paris acts within Paris only, and the strict mode refuses any address outside their subnets.
03
Fine-grained permissions
Seeing a device, reading its configuration, opening a session, running a script, replaying a recording: each is a separate permission, so a role gives exactly what a job needs.
04
Secrets never leave the server
Credentials are encrypted in the Vault with a key you control, generated at installation or supplied by you. No API, page, log or error ever returns a secret.
05
One recorded access path
The SSH bastion opens sessions from the browser with the Vault credential, records each one for replay with its fingerprint, captures every command and flags the risky ones against built-in and custom rules.
06
Strong identity
Sign in with your identity provider through OpenID Connect, with its MFA and conditional access, or with LDAP and Active Directory. Accounts follow your directory.
07
Everything is traced
Every change of a setting, a rule, an access or a credential, every refused write, every export and every read of sensitive content writes an audit record you can export to your SIEM.
08
No blind retries on your AAA
A refused login is never retried blindly, and a circuit breaker per credential and device family protects your TACACS+ and RADIUS accounts from lockouts.
09
Sovereign by design
ConnectMyAssets runs on your own infrastructure with one single outbound connection to our infrastructure, and we have no access to your data: no vendor tunnel into your network.
SEE IT IN ACTION
One controlled access path: the operator never sees the password, and every command is recorded and auditable.Who holds what, on which site, and every action written in the audit trail.
HOW IT WORKS
Zero trust principles, mapped to the platform
Verify explicitly
Identity from your provider, MFA, and a permission check on every request against the site and subnet of the target.
Least privilege access
Roles on asset groups, separate permissions for reading, connecting, running and replaying, and no visibility at all outside the granted perimeter.
Assume breach
Secrets out of the engineer's hands, every session recorded, every command captured, every sensitive action audited: an incident can be retraced end to end.
A PRACTICAL WORKFLOW
Your path to zero trust administration
01
Connect your identity provider
OIDC or LDAP, with the MFA you already enforce.
02
Model your sites and subnets
Asset groups by site or entity, subnets declared or discovered from your devices.
03
Grant roles, move credentials to the Vault
Each team gets its perimeter; device credentials are imported once and no longer shared.
04
Route administration through the bastion
Then restrict device SSH to ConnectMyAssets if you wish, and review sessions and the audit trail.
FAQ
Your questions, answered.
Prepare your project and define your scope.
Is ConnectMyAssets a zero trust solution?
Zero trust is an approach rather than a single product. ConnectMyAssets is zero trust ready for network administration: it verifies every request against the identity and the rights of the user on the target's site and subnet, applies least privilege, keeps device credentials out of reach, routes sessions through a recorded bastion and audits every sensitive action. It fits next to your identity provider, your SIEM and your network access controls.
Do engineers still need the device passwords?
No. Credentials are stored in the Vault and used on the server side by the bastion, the collection and the scripts. The engineer opens a session from the browser without ever seeing the password, and every session is recorded.
How is MFA handled?
Through your identity provider. ConnectMyAssets signs users in with OpenID Connect, so the MFA and conditional access policies of your provider apply. LDAP and Active Directory are supported as well.
Can an engineer reach a device outside their site?
Not by default. Rights follow your sites and subnets, and the strict mode refuses any address outside the subnets an engineer can see. If you need it, the relax mode lets only the accounts you give a dedicated right reach such an address, with a credential typed for the session, recorded and audited.
Does this help with NIS2, DORA or ISO 27001?
Yes. Access control, privileged access management, logging and traceability are expected by NIS2, DORA and ISO 27001. The roles, the recorded sessions and the audit trail give you the evidence of who did what on your network.
