Devices & office network — N1 IT Landscape
N1 IT Landscape — The Blueprint · CF-Access internal
Devices & office network
Section titled “Devices & office network”N1 IT Landscape · Owner: Arun Venkataraman · source of truth: markdown SSOT
N1 IT Landscape — Devices & office network
Section titled “N1 IT Landscape — Devices & office network”CURRENT-STATE as of 2026-06-09 · part of the N1 IT Landscape (start at Overview). Owner: Arun Venkataraman (Principal Engineer).
The machines people use and the office network they sit on (both provided through Deriv).
2. ENDPOINTS & DEVICES
Section titled “2. ENDPOINTS & DEVICES”| Device class | Who | OS / Notes |
|---|---|---|
| MacBook Pro (company) | All onsite staff (Malaysia); 2 remote staff | 14-inch MacBook Pro, Space Black, M5 Pro (15-core CPU, 16-core GPU, 16-core Neural Engine), macOS. Longer-tenured employees are on the previous-generation 14-inch MacBook Pro. |
| Personal laptops | Most remote contractors (India) | Mixed; not company-managed |
| Alienware laptop (Deriv-provided) | Arun | Alienware m18 R2 — Intel Core i9-14900HX (24c/32t), 62 GiB RAM, NVIDIA RTX 4090 Laptop GPU (16 GB) + Intel UHD. Kubuntu : Ubuntu 24.04.4 LTS, kernel 6.17 (oem), KDE Plasma 5.27.12. The one non-Mac primary endpoint. |
- 🔒 Endpoint posture is identity-and-network-enforced, not MDM-enforced. Because most remote machines are personal/unmanaged, N1 does not rely on device management for security. Instead, the control points are: (a) Cloudflare WARP client installed and always-on, (b) mandatory company Google sign-in , and (c) mandatory 2FA (see §4). A laptop with no WARP + Google identity simply cannot reach anything internal.
- The office network itself is watched by CrowdStrike (Deriv-provided, see §3).
3. NETWORK & PHYSICAL (Deriv-provided office)
Section titled “3. NETWORK & PHYSICAL (Deriv-provided office)”N1’s office Wi-Fi/LAN is delivered through Deriv’s network stack (shared building, shared infrastructure):
| Layer | Technology |
|---|---|
| Wireless access points | Aruba APs |
| Wireless/network control | Cisco Meraki controllers |
| Firewall / edge | Fortinet FortiGates |
| Endpoint/network threat detection | CrowdStrike (watching the network) |
Key point: N1 does not run its own office network gear — it consumes Deriv’s. N1’s own security boundary is therefore not the office firewall; it is Cloudflare (identity + WARP + Access + WAF + Tunnels) wrapped around cloud resources that have no public inbound exposure at all (§6, §8). This means an N1 engineer is equally protected whether on the Deriv office Wi-Fi, on hotel Wi-Fi in S.E. Asia, or at home in India — the perimeter travels with the WARP client, not the building.