RESOURCES
Every external reference is selected from a government agency, an international standards body or a non-profit, with vendor marketing material excluded, so any of it can be cited directly in a technical assessment or a compliance audit. The engineering column is written by the Kunan team from hands-on experience, and the accompanying public documents are free to download.
Architecture analysis and deployment practice, written by the Kunan technical team.
SDP v3.0 demotes single packet authorisation from definition to option. What the new guide actually changed, why SPA struggles on IoT and cloud functions, where the line between SDP and microsegmentation really falls, and what to do first.
What CISA’s exploited-vulnerability catalogue says about VPN vulnerabilities: how many in six years, why patching starts late, and what a patch cannot undo.
A software-defined perimeter puts the boundary at each resource: three roles, why single packet authorisation leaves scanners no reply, and what it misses.
Foundational standards, frameworks and legislation on zero trust and SDP, published by government agencies and standards bodies.
The baseline definition of zero trust, setting out how the policy engine, policy administrator and policy enforcement point divide responsibility. Almost every later architecture argument references it.
csrc.nist.gov
Extends the SP 800-207 principles into multi-cloud and service mesh environments, showing how identity and authorisation move down to the level of an individual service.
csrc.nist.gov
The specification for SDP itself, defining single packet authorisation and the separation of control and data planes — the architectural model Merak is built on.
cloudsecurityalliance.org
Public implementation guides, adversary behaviour knowledge bases and threat intelligence sources for benchmarking your own environment.
NCCoE’s full record of building several zero trust architectures in a lab, including real configurations and the problems encountered — the closest thing to a public implementation log.
csrc.nist.gov
A matrix of tactics and techniques drawn from observed intrusions. The lateral movement entries map directly onto what a segmentation policy needs to cover.
attack.mitre.org
Vulnerabilities with evidence of active exploitation. For prioritising a patch schedule, this tracks real risk more closely than a CVSS score does.
cisa.gov
Protocol specifications, identity guidance and testing methodologies in their authoritative form, citable directly in engineering and audit work.
The protocol behind mTLS point-to-point encryption, including the handshake flow and the reasoning behind forward secrecy.
rfc-editor.org
Concrete guidance on which cipher suites to enable and which versions to disable — more directly applicable to configuration than the protocol document itself.
rfc-editor.org
The rules for chain validation, validity periods and revocation — the foundation for designing a device identity certificate hierarchy.
rfc-editor.org
The documents most often requested during procurement and security review, with no registration.
The full operating procedure — account activation, Merak Agent installation and device enrolment, member management, application and node deployment, and role and administrator permissions — with a troubleshooting appendix and a device status reference. Covers Merak Agent 1.4.2.
Some specifications and deployment case studies are shared under NDA. Describe what you need and the team will follow up.
