Roadmap

This roadmap provides a structured implementation sequence for Control-Plane Security Onion deployment.

Implementation Order

1. Outer Layer – Establish boundary protections

2. Middle Layer – Enforce authentication and encryption controls

3. Core Layer – Apply least-privilege, service exposure reduction, and monitoring controls

Each layer should be validated before proceeding to the next.

Deployment Phases

Phase 1 – Boundary Hardening Isolate management access and restrict network reachability.

Phase 2 – Identity and Encryption Enforcement Integrate centralized AAA, enforce MFA, and harden TLS configurations.

Phase 3 – Control-Plane Surface Reduction Apply RBAC refinement, Self IP Port Lockdown, appliance mode, and logging integration.

Phase 4 – Operational Validation Validate configurations using iHealth and perform access testing.

Operational Readiness Checkpoints

Before advancing layers:

• Confirm administrative access continuity

• Validate HA and ConfigSync stability

• Test break-glass recovery

• Verify logging and alerting functionality

Maturity Model

Basic – Outer Layer only Intermediate – Outer + Middle Advanced – Full Outer + Middle + Core

Enterprise environments should implement all three layers.