A private workplace, with a clear perimeter

A private workplace is less a product than a perimeter that can be described on one page: who may enter, what each person may reach, how they prove who they are, and what the firm does when access changes.

Identity proven with keys

A stolen login can undermine every other control a firm has in place. A second factor helps, and the choice of factor matters. NIST’s Digital Identity Guidelines, SP 800-63B-4 state that one-time codes and out-of-band authenticators are not phishing-resistant, because a counterfeit login page can relay a typed code. The same guidance cites WebAuthn, used by FIDO2 security keys and passkeys, as a phishing-resistant method: the credential is bound to the genuine site’s name.

For partners, administrators and anyone who approves payments, hardware security keys or platform passkeys are the stronger choice. The NSA-led Deploying AI Systems Securely guidance points the same way: phishing-resistant MFA for access, and dedicated privileged workstations for administrators.

One sign-in, few privileges

Private single sign-on places internal applications behind one identity, one MFA policy and one place to grant or remove access. It simplifies the work of offboarding. It does not end every session on its own. Applications may hold their own sessions, refresh tokens, offline caches or synchronised files. Deprovisioning has to propagate from the identity provider to each application and revoke active sessions and tokens there. That path deserves a test: disable a test account and confirm, application by application, that access ends within the expected time.

Sign-on establishes who someone is. Roles establish what they may do. OWASP’s Authorization Cheat Sheet sets out the principles: enforce least privilege, deny by default, and validate permissions on every request. Its test suits a partners’ meeting: each permission should have a stated reason. Periodic role reviews, and administrator rights granted for a task rather than held permanently, keep the model close to that ideal.

Recovery planned in advance

People lose phones and keys. If recovery is a phone call and a new password, recovery becomes the easiest way in. NIST SP 800-63B-4 advises services to encourage each person to keep at least two separate means of authentication. It treats recovery codes as secrets: generated with at least 64 bits of randomness, kept offline by the user, stored hashed by the system, and rate-limited when tried.

A practical arrangement might include two registered keys per partner with one held in a safe, sealed recovery codes, and a written procedure in which a second person confirms identity before access is reissued.

Investor portals: one investor, one space

An investor portal publishes some of the most sensitive documents a firm produces: capital calls, statements, tax documents, side letters. The core rule is segregation. Each investor sees their own documents and the fund documents they are entitled to, and nothing else.

A familiar failure is a document link that contains an identifier, where changing one character opens another investor’s file. OWASP’s guidance on insecure direct object references is direct: check access for each object on each request. Hard-to-guess identifiers add depth but do not replace the check.

Documents should be encrypted at rest and in transit, with keys held apart from the files. The NSA guidance recommends keeping encryption keys in a hardware security module.

Expiry and download controls

Useful controls for shared documents include:

• Access that expires: a data room that closes after a transaction, a guest account that ends with a mandate.
• View-only access for drafts, with downloads reserved for final versions.
• Per-user watermarks naming the viewer and the time.
• A record of each view and download.

These controls reduce casual leakage and create a record. They cannot prevent a determined recipient from photographing a screen. Beyond the screen, the firm relies on agreements, relationships and the audit trail.

Logs, backups and upkeep

Sign-ins, permission changes, document access and administrator actions belong in the log. OWASP’s Logging Cheat Sheet advises masking or excluding access tokens and sensitive personal data, and protecting logs against tampering. Logs about client documents are themselves confidential and need their own access limits and retention period.

Backups should be offline and encrypted, and restored in practice. CISA’s #StopRansomware Guide notes that many ransomware variants seek out reachable backups. Monaco’s data protection law, Loi n° 1.565, Article 31, calls for measures that restore availability after an incident and for regular testing of security measures. This is general information rather than legal advice.

Maintenance cadence follows risk: critical security fixes are tested and applied promptly, routine updates follow a set calendar, and each change has a named owner.

The controls described here are illustrative and are scoped to each firm. To map your own perimeter, write to contact@desgarde.com.