Ed SkarkeService Catalog Create account Sign in

Drawing set · Rev A · issued 2026-09-17

The drawings

Seven sheets — a cover and six drawings — of the ideas this work is built on: segmentation at the host, telemetry at fleet scale, replication and failover, migration in waves, baselines as code, and the storage fabric. Each is drawn as an architect would draw it, and each moves.

11 22 33 44 55 66 77 88 AA BB CC DD EE FF GENERAL NOTES 1.Every sheet traces to a public source: therunning estate, published code, theprofessional profile, or the résumé the setwas drawn from.2.Numbers on a sheet are the ones alreadypublic. Where a figure is rounded, it isrounded down.3.Motion is CSS only. With reduced motionrequested, every sheet is a complete staticdrawing.4.Sheets are read in any order; S-01, S-02 andS-05 form one loop (segment, observe,measure).5.Present mode (the button above the set)shows one sheet at a time, sized to thescreen; the arrow keys page through them.Print gives one sheet per landscape page. DRAWING SET · REV A · 2026-09-17 Infrastructure that explains itself. Six drawings from the estate this site runs on and the work behind it. Each sheet moves; with reduced motion requested it is a complete still drawing. SHEET INDEX DRAWS FROM S-01 Micro-segmentation at the host Security posture · zero trust S-02 Fleet telemetry at scale Evidence S-03 Continuity: replication and failover Continuity S-04 Migration in waves Operating discipline S-05 Baselines as code Security posture · baseline S-06 The storage fabric Continuity · scale LINE TYPES brass, moving — traffic that a decision allowed patina, moving — replication and measurement red, ending in a cross — refused, and recorded graphite, dashed — structure and delivery a dimension — a number that is public a callout — a note that matters revision cloud — what changed since the last issue PROJECT SKARKE.NET — INFRASTRUCTURE & IDENTITY DRAWN E. Skarke CHECKED against the running estate SHEET TITLE Cover sheet and index what is in the set, and how to read it skarke.net — infrastructure & identity · drawing set SCALE NTS DATE 2026-09-17 REV A STATUS for review SHEET S-00 of S-06 ISSUED FOR REVIEW
11 22 33 44 55 66 77 88 AA BB CC DD EE FF GENERAL NOTES 1.Rulesets are generated from the entitlementcatalogue, never hand-kept. A change to whomay reach what is a change to the catalogue;the rules follow.2.Delivery is group policy or an agent. Theswitch, the VLAN and the addressing areuntouched, which is what makes thisdeployable across a global Windows estatewithout a network project.3.A refused probe is evidence, not silence:every refusal is recorded and reaches theSOC pipeline (see S-02).4.The planning tooling observes real flowsfirst, so a host is never cut off fromsomething it was actually using.5.Drawn from an in-subnet micro-segmentationprogramme on a global Windows Server estate— host firewall, group policy and bespokePowerShell planning tooling. 01 · ONE SUBNET, SEGMENTED AT THE HOST Entitlement catalogue who may reach what — the source Generated rulesets one per host, from entitlement Delivery group policy · agent · no network change rulesets land on every host planning tooling: PowerShell — flows observed, then entitled ONE SUBNET · SAME BROADCAST DOMAIN · NO VLANS ADDED · NO RE-ADDRESSING host 1 finance host 2 build host 3 web host 4 db host 5 batch host 6 jump entitled: build → db, tcp/1433 — passes lateral movement: jump → finance — refused, and recorded not entitled: web → batch — refused at the host the network is unchanged — segmentation lives on the host PROJECT SKARKE.NET — INFRASTRUCTURE & IDENTITY DRAWN E. Skarke CHECKED against the running estate SHEET TITLE Micro-segmentation at the host zero trust inside one subnet — policy from entitlement, delivered by GPO skarke.net — infrastructure & identity · drawing set SCALE NTS DATE 2026-09-17 REV A STATUS for review SHEET S-01 of S-06 ISSUED FOR REVIEW
S-01 One subnet, no re-addressing: every host carries a ruleset generated from the entitlement catalogue and delivered by group policy. Entitled traffic passes; anything else is refused at the host and recorded.
11 22 33 44 55 66 77 88 AA BB CC DD EE FF GENERAL NOTES 1.Collectors are self-contained: they extractconfiguration, event and communication dataon their own and do not depend on the userdescribing the problem.2.The pipeline routes, reduces and enrichesBEFORE the SIEM indexes. Retention is adecision made here, so the index neverbecomes the thing that fails first.3.Dashboards are built for a decision: whichnetwork failure point to fix first, whichentitlement is missing, who owns a systemand whether it is patched.4.Proven at 80,000 managed endpoints on anAppGate-based zero-trust, cloud-managedendpoint deployment, and on Windows Factsdashboards spanning thousands of systems.5.The same data draws the segmentation policyon S-01 and closes the loop on S-05. 02 · TELEMETRY AT FLEET SCALE MANAGED ENDPOINTS 80,000 endpoints Windows collector config · events · comms Network devices firewalls · access proxy logs Endpoint security EDR detections and state self-contained · no dependency on what the user remembers Pipeline retention is decided here route · reduce · enrich so the index never fails first SIEM index · search · alert Network failure points engineers prioritise, not guess Entitlement gaps who cannot reach what they should Ownership · patch · capacity thousands of systems, one screen volume reduced before it is indexed diagnosis without asking the user — the dashboard already knows PROJECT SKARKE.NET — INFRASTRUCTURE & IDENTITY DRAWN E. Skarke CHECKED against the running estate SHEET TITLE Fleet telemetry at scale self-contained collectors, a reducing pipeline, dashboards for a decision skarke.net — infrastructure & identity · drawing set SCALE NTS DATE 2026-09-17 REV A STATUS for review SHEET S-02 of S-06 ISSUED FOR REVIEW
S-02 Self-contained collectors feed a pipeline that routes, reduces and enriches before the SIEM ever sees the data, so the dashboards engineers act on can be built for 80,000 endpoints without the index becoming the thing that fails.
11 22 33 44 55 66 77 88 AA BB CC DD EE FF GENERAL NOTES 1.Recovery point and recovery time are designnumbers, agreed and written down beforeanything is built; the rehearsal measureswhether the build meets them.2.Replication is array-level and journaledwith consistency groups, so a database andits logs recover to the same instant.3.Failover is orchestrated (protection groups,recovery plans) and rehearsed both ways: thefailback is the half that is usuallyforgotten.4.A third site carries continuity ofoperations, so the plan survives the loss ofa region, not just a room.5.Drawn from designing and running a firstmulti-site SAN with array replication andsite recovery orchestration, and moving apetabyte of file, mail, database, web andvirtualisation services between sites. 03 · TWO SITES, ONE PROMISE SITE A primary · serving Compute virtualisation cluster Storage array · tiers · snapshots Services file · mail · database · web Recovery orchestration protection groups · recovery plans SITE B recovery · ready Compute virtualisation cluster Storage array · tiers · snapshots Services file · mail · database · web Recovery orchestration protection groups · recovery plans array replication · journaled consistency groups SERVING failover, then failback — rehearsed, not hoped for THIRD SITE · CONTINUITY OF OPERATIONS the plan survives losing a region, not just a room RPO — the most data the design allows to lose RTO — the longest the service is allowed to be down both are design numbers written down first — then measured on the rehearsal one petabyte moved between sites this way — file, mail, database, web, virtualisation PROJECT SKARKE.NET — INFRASTRUCTURE & IDENTITY DRAWN E. Skarke CHECKED against the running estate SHEET TITLE Continuity: replication and failover two sites, journaled replication, a rehearsed recovery plan skarke.net — infrastructure & identity · drawing set SCALE NTS DATE 2026-09-17 REV A STATUS for review SHEET S-03 of S-06 ISSUED FOR REVIEW
S-03 Two sites, journaled array replication with consistency groups, and a recovery plan that has been run both ways. Recovery point and recovery time are written down as design numbers and then measured.
11 22 33 44 55 66 77 88 AA BB CC DD EE FF GENERAL NOTES 1.Analysis before movement: every link isresolved and every embedded reference foundbefore a single share moves. The surprise isfound on a spreadsheet, not on a Monday.2.References live inside files, not only inshortcuts — Office documents, Visiodrawings, and Access databases in tables,forms, macros and VBA. They are rewritten,not left to break.3.Waves have a gate. The rollback is writtenbefore the wave; the gate is passed byverification, not by the calendar.4.Drawn from a domain-integrated DFS data-pathmitigation across global storage — Goldfire,Office documents and Access databases:100,000-plus links analysed and 139,000references updated by scripted tooling overSplunk-enriched data and custom dashboards.5.The same discipline moved a petabyte betweensites (S-03) and delivered 300-plus serversagainst merger deadlines. 04 · MIGRATION IN WAVES OLD NAMESPACE domain-integrated DFS · global storage \\corp\finance\\corp\eng\cad\\corp\eng\cad\rev\\corp\ops\\corp\hr\forms Link analysis engine 100,000+ links resolved references found inside files Office · Visio · Access internals NEW STORAGE new paths · same data · verified \\stor\finance\\stor\eng\cad\\stor\eng\cad\rev\\stor\ops\\stor\hr\forms 139,000 references rewritten — tables, forms, macros and VBA WAVES · a rollback is written before each one wave 1 pilot: one teamwave 2 engineering, eveningswave 3 finance, no month-endwave 4 operations, by regionwave 5 long tail, decommission every wave: analyse → move → verify → rewrite references → gate the servers were led through it with minimal disruption — because the analysis came first PROJECT SKARKE.NET — INFRASTRUCTURE & IDENTITY DRAWN E. Skarke CHECKED against the running estate SHEET TITLE Migration in waves a namespace move with every link accounted for first skarke.net — infrastructure & identity · drawing set SCALE NTS DATE 2026-09-17 REV A STATUS for review SHEET S-04 of S-06 ISSUED FOR REVIEW
S-04 A namespace move where every link is resolved and every embedded reference found before anything moves — then waves, each with a rollback written first and a gate passed by verification.
11 22 33 44 55 66 77 88 AA BB CC DD EE FF GENERAL NOTES 1.A framework becomes baseline definitionsheld as versioned data. The deliverymechanism — group policy, MECM/SCCM, an APIor a script — is chosen per setting, not perframework.2.Every control has a measurement. Drift isread from the fleet on a cycle, so thecompliance figure is an observation, never astatement.3.An exception is a risk acceptance with anowner and an expiry, coordinated withgovernance; it is not a silent gap in thereport.4.Patch deployment rides the same loop — thetools differ, the discipline does not.5.Drawn from CIS baseline deployment across aglobal Windows estate via directory policy,configuration management and PowerShell, andfifteen years of compliance-framework work. 05 · BASELINES AS CODE Frameworks CIS · NIST · PCI DSS · DoD 8500 Baseline definitions settings as data, versioned Delivery GPO · MECM/SCCM · API · script Fleet servers · workstations · appliances Measure drift SIEM dashboards · SQL reporting Remediate — or accept risk acceptance: an owner and an expiry DRIFT measured, not asserted — falls every cycle, never assumed zero patching: MECM · WSUS · Tanium — the same loop evidence for audit is generated by the loop, not assembled for it fifteen years of compliance frameworks, operated as one loop PROJECT SKARKE.NET — INFRASTRUCTURE & IDENTITY DRAWN E. Skarke CHECKED against the running estate SHEET TITLE Baselines as code CIS · NIST · PCI · DoD 8500 by policy, measured as drift skarke.net — infrastructure & identity · drawing set SCALE NTS DATE 2026-09-17 REV A STATUS for review SHEET S-05 of S-06 ISSUED FOR REVIEW
S-05 Frameworks become versioned baseline definitions, delivered by whatever mechanism fits each setting, and closed as a loop: drift is measured from the fleet, and an exception is a risk acceptance with an owner and an expiry.
11 22 33 44 55 66 77 88 AA BB CC DD EE FF GENERAL NOTES 1.Two fabrics that share nothing. A hostreaches every LUN by two paths; a firmwareupdate or a failed director is a Tuesday,not an outage.2.Tiers are chosen by what the data needs —latency, capacity, retention — withdeduplication and archiving where they earntheir keep.3.Snapshots, replication and backup answerthree different questions (operator mistake,site loss, everything else) and none of themsubstitutes for another.4.Zoning, firmware, alerting and performanceare managed from one console; theconfiguration of the fabric is documentedand auditable.5.Drawn from serving as a storage-area-networklead architect and modernising fibre-channelfabrics for global sites, across EMC, HP,Dell and Brocade equipment. 06 · THE STORAGE FABRIC virtualisation host two HBAs · two paths database server two HBAs · two paths file services two HBAs · two paths mail cluster two HBAs · two paths FABRIC A · fibre channel · director + edge switches FABRIC B · independent — no shared component with A Array · tier 1 flash — latency-bound work snapshots every 15 min replicated → S-03 Array · tier 2 SAS — general purpose deduplicated thin, monitored for growth Archive and backup nearline — retention tier tape library — offline copy cloud backup — offsite Fabric and array performance monitoring zoning, firmware, alerting, capacity and latency — eight years of it on one console, before it was fashionable no single path tiers by performance and retention — snapshot, replication and backup are three different questions run and maintained at 1,200-plus servers; configurations audited from 1,100 of them by tooling PROJECT SKARKE.NET — INFRASTRUCTURE & IDENTITY DRAWN E. Skarke CHECKED against the running estate SHEET TITLE The storage fabric dual fabrics, arrays in tiers, three different kinds of copy skarke.net — infrastructure & identity · drawing set SCALE NTS DATE 2026-09-17 REV A STATUS for review SHEET S-06 of S-06 ISSUED FOR REVIEW
S-06 Two fibre-channel fabrics that share nothing, arrays in tiers by what the data needs, and the three different kinds of copy — snapshot, replication, backup — that answer three different questions.