---
title: "Devices & office network — N1 IT Landscape"
---

N1 IT Landscape — The Blueprint · CF-Access internal

# Devices & office network

N1 IT Landscape · Owner: Arun Venkataraman · source of truth: markdown SSOT

# N1 IT Landscape — Devices & office network

> **CURRENT-STATE** as of **2026-06-09** · part of the **N1 IT Landscape** (start at **[Overview](/landscape/overview/)**). Owner: **Arun Venkataraman** (Principal Engineer).

_The machines people use and the office network they sit on (both provided through Deriv)._

* * *

## 2\. ENDPOINTS & DEVICES

Device class | Who | OS / Notes  
---|---|---  
MacBook Pro (company) | All onsite staff (Malaysia); **2** remote staff | **14-inch MacBook Pro, Space Black, M5 Pro** (15-core CPU, 16-core GPU, 16-core Neural Engine), macOS. Longer-tenured employees are on the **previous-generation** 14-inch MacBook Pro.  
Personal laptops | Most remote contractors (India) | Mixed; not company-managed  
Alienware laptop (**Deriv-provided**) | **Arun** | **Alienware m18 R2** — Intel Core i9-14900HX (24c/32t), 62 GiB RAM, NVIDIA RTX 4090 Laptop GPU (16 GB) + Intel UHD. **Kubuntu** : Ubuntu 24.04.4 LTS, kernel 6.17 (oem), KDE Plasma 5.27.12. The one non-Mac primary endpoint.  
  
  * 🔒 **Endpoint posture is identity-and-network-enforced, not MDM-enforced.** Because most remote machines are personal/unmanaged, N1 does not rely on device management for security. Instead, the control points are: (a) **Cloudflare WARP** client installed and always-on, (b) mandatory **company Google sign-in** , and (c) **mandatory 2FA** (see [§4](/landscape/identity/)). A laptop with no WARP + Google identity simply cannot reach anything internal.
  * The office network itself is watched by **CrowdStrike** (Deriv-provided, see §3).

* * *

## 3\. NETWORK & PHYSICAL (Deriv-provided office)

N1's office Wi-Fi/LAN is **delivered through Deriv's network stack** (shared building, shared infrastructure):

Layer | Technology  
---|---  
Wireless access points | **Aruba APs**  
Wireless/network control | **Cisco Meraki controllers**  
Firewall / edge | **Fortinet FortiGates**  
Endpoint/network threat detection | **CrowdStrike** (watching the network)  
  
Key point: N1 does **not** run its own office network gear — it consumes Deriv's. N1's own security boundary is therefore **not** the office firewall; it is **Cloudflare** (identity + WARP + Access + WAF + Tunnels) wrapped around cloud resources that have **no public inbound exposure at all** ([§6](/landscape/cloudflare/), [§8](/landscape/aws/)). This means an N1 engineer is equally protected whether on the Deriv office Wi-Fi, on hotel Wi-Fi in S.E. Asia, or at home in India — the perimeter travels with the WARP client, not the building.

* * *