Automating firewall rule deployment in a highly regulated environment#

João Soares · Ørsted (per talk content)

• Why: The strongest network-security item in the program: policy-as-code firewall automation with hard production numbers, in a highly regulated energy company.
• What: DRAGØN, Ørsted's self-service firewall platform: internal customers define, validate and deploy their own rules via a request form or full GitOps workflow, with no firewall team involvement. Results as of 2026: 40+ teams, 150+ users, 3,500+ successful deployments, 3,000+ rejected-by-validation attempts, automated requests 0% → 80%, human-handled lead time down 88% — and total request volume up ~250%, exposing the hidden cost of the old slow process.
• How: Security principles were moved out of SharePoint/Word/gut-feeling into policy-as-code: custom Nautobot models abstracting business/security concepts, related to real network constructs, connected by policy, exposed to humans via GUI and machines via API. Validation runs automatically against those policies; security is pulled in automatically when a rule requires it; Terraform deploys to the firewall management platform and Ansible commits to the firewalls. Compliant-by-design, fully versioned and revertable.
• Where applicable: Regulated-enterprise specific (Danish critical energy infrastructure), but the pattern — security policy as queryable models rather than documents, plus treating the automation as a real product with versioning/changelog/support — transfers to any security-governed org.