Secure Cloud Migration — Drive On Transportation

Problem

Drive On Transportation LLC ran a distributed logistics operation across multiple sites with no unified security architecture. Identity was fragmented, access controls were inconsistent across roles, and the company had no hardened cloud footprint to consolidate workloads, enforce least privilege, or satisfy the compliance expectations placed on a transportation and freight business.

Approach

Architected a secure cloud migration strategy on Google Cloud Platform, applying defense-in-depth across every layer of the stack.

• 5-tier Role-Based Access Control (RBAC) — designed a five-role model and enforced it through collection-level Firestore security rules, so every read and write was bound to the caller's role rather than the client's word.
• Cloud Armor WAF — configured the Web Application Firewall with OWASP Top 10 protections to filter malicious traffic before it reached origin services.
• Network isolation — VPC firewall rules locked down east-west traffic, and Cloud NAT provided controlled, single-egress outbound access so no workload talked to the internet directly.
• Encryption everywhere — AES-256 encryption at rest and TLS 1.3 in transit across all services, with keys managed through GCP's key management service.
• IAM least privilege — enforced least-privilege IAM across multi-cloud platforms, mirroring the zero-trust posture applied to the broader Drive On environment.

The design was documented and risk-managed against the NIST 800-53 / NIST Risk Management Framework, giving the migration a defensible control set rather than a collection of point fixes.

Outcomes

The migration produced a hardened, auditable cloud environment that consolidated Drive On's distributed operations under a single security posture — role-scoped access, WAF-fronted services, locked-down networking, and end-to-end encryption aligned to NIST controls.