Zero Trust "Black Cloud" Overlay

The Zero Trust "Black Cloud" Overlay is a managed service built on Zscaler Private Access. Moraph licenses, designs, configures and operates it so that your applications make only outbound connections and have no inbound listening ports or public IP addresses for an attacker to find. Access is decided per user, per device and per application by policy your organization approves, and every decision is logged for your security team and assessors.

The problem it solves

Many mission and business applications are still reached through VPN concentrators and firewall rules that expose an address and an open port to the internet. Once an attacker or a compromised device is on the network, the same flat access that lets staff reach their applications lets the attacker map and probe everything else. Programs are directed to move to zero trust, but the work of segmenting applications, rewriting access rules around identity and keeping the evidence for assessors falls on teams already running operations.

Who it’s for

• Defense and intelligence program offices moving applications to zero trust access
• Information system security managers and officers responsible for authorization evidence
• Network and security operations teams who run remote and site access today
• Mission application owners who need their systems reachable only by the people who use them
• Assessors and inspectors who review access controls and logs

1. Onboard an applicationEach application is moved behind the overlay in a planned sequence: Moraph places App Connectors next to it, defines it as a segment, and writes the access policy your application owner approves.
2. Grant and review accessZscaler evaluates each connection against the user's identity, group and device posture before brokering it to one application. Moraph keeps the policies aligned to the groups your identity team manages and runs periodic access reviews.
3. Monitor and respondConnector health, policy denials and unusual access are streamed to your SIEM and watched by Moraph's operations team, who triage alerts and hand confirmed incidents to your security operations team.
4. Change and evidenceEvery change to segments, policies or connectors goes through your change process against an approved configuration baseline, and the resulting records feed your authorization package and continuous monitoring.

Applications hidden from the internet

Zscaler App Connectors make outbound connections to the Zscaler cloud, so protected applications need no inbound ports or public addresses.

Per-application access

Zscaler brokers each user to the specific applications their policy allows, rather than placing them on a network segment.

Identity-based policy

Access policies are written around groups from your identity provider, with Moraph keeping the mapping current as groups change.

Device posture checks

Policies can require device conditions such as a managed certificate or an approved client before access is granted.

Private Service Edge

Where your policy requires brokering inside your own environment, Moraph deploys and runs Zscaler Private Service Edges there.

Segmentation design

Moraph groups applications into segments by mission, sensitivity and user population, documented for your assessors.

Configuration baseline

An approved baseline of segments, policies and settings, compared against the live configuration on a schedule with differences reported.

Log streaming to your SIEM

Access and connector logs are streamed to the security information and event management system you already run.

Alert triage

Moraph's operations team watches connector health and unusual access and hands confirmed issues to your security team with the evidence.

Change control

Every policy and connector change is raised, approved through your process, applied and recorded against the baseline.

Access reviews

Lists of who can reach each application, prepared for application owners to certify, with removals tracked through to completion.

Authorization evidence

Control mappings, configuration records and logs packaged to support your organization's own authorization and continuous monitoring.

Application owner

Decides who should reach their application and approves its access policy

ISSM or ISSO

Approves architecture and policy changes and owns the authorization evidence

Security operations

Receives escalated alerts and leads incident response

Moraph service manager

Runs the service, change process and monthly service reviews

Moraph platform engineer

Configures policies and connectors and triages alerts, under your approvals

Assessor or inspector (read-only)

Reviews configuration, logs and evidence without changing anything

Identity provider

Users authenticate through your identity provider using SAML, with group membership supplied for policy decisions, including where your identity provider supports PKI and CAC-based sign-in.

User provisioning

Users and groups synchronized from your directory through SCIM where your identity provider supports it.

SIEM

Zscaler log streaming sends access and connector events to your SIEM for correlation and retention under your policy.

Endpoint management

Device posture checks draw on the certificates and client settings your endpoint management tool deploys.

IT service management

Change requests, incidents and service requests are raised and tracked in your service management tool, or in Moraph's if you have none.

Network and firewall teams

After each application is onboarded, your network team removes the inbound rules and public addresses it no longer needs, with Moraph supplying the list.

Compliance tooling

Control mappings and evidence exported for your GRC or authorization tool.

Single sign-on

Administrators and users sign in through your identity provider, so your authentication and multi-factor policies apply.

Least-privilege administration

Moraph administrators hold role-based rights in the Zscaler admin portal limited to the tasks in the service scope.

Cleared US support staff

Tickets for federal and defense clients are handled only by US citizens with active clearances.

Complete audit trail

Every administrative change and access decision is logged with the person and time and kept under your retention policy.

US hosting for government

Moraph's service tooling for US government clients is hosted in the United States region only.

People decide

Where automation suggests a policy change or flags an anomaly, a named person reviews it; nothing is applied without approval.

Zscaler cloud with US-hosted management

Zscaler's government cloud offering where your requirements call for it, with Moraph's service tooling hosted in the United States region.

Private Service Edge in your environment

Brokering placed inside your data centers or enclaves where your policy requires traffic to stay within them.

Disconnected or classified environments

Where operations take place on classified networks, they are carried out under your organization's authority and procedures, by cleared staff, scoped in the proposal.

Discovery

We inventory the applications in scope, their users, hosts, ports and dependencies, and how they are reached today. We need application owners and your network team.

Architecture and design

We design segments, connector placement, policies and any Private Service Edges, and document the design for your ISSM.

Identity integration

Your identity provider and directory groups are connected, and groups are mapped to policies with your identity team.

Pilot

A small set of applications and users moves first, so access, posture checks and logging are proven before wider rollout.

Phased onboarding

Applications move in waves you approve, and after each wave your network team retires the inbound exposure it no longer needs.

Transition to operations

Runbooks, escalation paths, the configuration baseline and reporting are agreed, and the service moves into steady-state management.

• Moraph is not Zscaler. Zscaler owns and operates the platform, and its own service commitments, roadmap and outages apply.
• Licenses are subject to Zscaler's terms, which are passed through to your organization.
• Moraph does not authorize your systems. Your authorizing official makes that decision; Moraph maps controls and supplies evidence to support it.
• Hiding an application reduces its exposure but does not fix vulnerabilities inside it. Patching and hardening of the applications remain with their owners.
• Some applications, such as those that depend on server-initiated connections to clients, may need redesign or another access method; these are identified during discovery.
• Removing old firewall rules and public addresses is carried out by your network team; Moraph identifies them but does not change networks outside the service scope.
• Who is entitled to which application is your decision. Moraph configures and reviews policies but does not grant access on its own judgment.
• The service does not replace your security operations center; it supplies alerts and evidence to it.

• List the applications you would move first and check that each can work with outbound-only connectors
• Confirm your identity provider can supply the groups your access policies need
• Scan a pilot application from outside before and after onboarding and compare what is visible
• Review a sample configuration baseline and change record with your ISSM
• Agree with your security operations team which alerts Moraph triages and which come straight to them
• Read the responsibilities table against your existing support contracts and authorization boundary