Zero-trust in Ghana's public sector

Adaobi: Nana, you came into this role in 2023 after the public sector outage that took down Ghana.gov for nine hours. What did you find? Nana: I found exactly what you would expect after a perimeter breach. Every agency had its own firewall, its own VPN, its own idea of trust. Once an attacker was inside any one of those agency networks, lateral movement was trivial. We had a single Active Directory forest that thirty agencies shared. One compromised laptop in a district office could reach the national identity database. That is not a system you can patch. That is a system you have to redesign. Kwame: How do you sell a redesign to thirty agencies at once? Nana: You do not. You sell it to three. We picked three pilot agencies — Revenue, Health, and a small ministry — and we said: we will do this for you, you will not pay for it, and at the end you will have a measurably better security posture and a faster developer experience. The faster developer experience was the hook. We deployed a centralized identity provider, mTLS between services, and short-lived credentials everywhere. The Revenue team noticed within three months that their engineers were shipping faster because they no longer had to file paperwork for every cross-service call. That story did our marketing for the next twenty-seven agencies. Adaobi: What did the technology stack look like? Nana: SPIFFE and SPIRE for workload identity. Keycloak for human identity, federated to each agency's existing user store where it existed. Open Policy Agent for policy. A custom audit pipeline built on Vector and ClickHouse because we needed to retain seven years of access logs and the commercial options were a non-starter on budget. Everything ran on a hardened Kubernetes substrate that we built with the National Information Technology Agency. The whole stack is open source. We publish the platform code on the government's GitHub. Kwame: What about the audit and attestation layer? Nana: This is the part I am most proud of. Every API call across the government substrate produces a signed audit event. The signature uses a per-workload key that is rotated daily. The events stream to a tamper-evident log that the Auditor-General's office can query directly. Before this, audit was a quarterly exercise that involved CSV exports and a lot of trust. Now it is continuous. The Auditor-General can ask, today, which user accessed which record at which time, and get an answer in seconds with cryptographic proof. Adaobi: What is your advice to other African governments looking at zero-trust? Nana: Start with identity. Do not start with network. Identity is the cheaper and more durable foundation. Pick three friendly agencies and over-invest in them. Make the developer experience better, not just the security posture better — that is how you get organic adoption. And budget for the audit pipeline from day one. The audit pipeline is not a nice-to-have. It is the thing that gives your minister political cover to keep funding the work. Kwame: Thank you, Nana. We are rooting for the next phase. Nana: Thank you for having me.