Role-Based Data Domain Separation

Virtual private networks are commonly used to connect remote branch offices and telecommuters to the central office in a secure matter. Exactly the same technology can be used to interconnect chosen machines on local area networks.

In this case the employees role in the company,  and the sensitivity of the data they are permitted to handle, take precedence over the network topology and geographical placing issues.

Not a single bit of sensitive data passes your network unencrypted, thus separating trusted employees or directors from the rest of the network by a wall of seemingly random data. Un-trusted employees (even if they are the company IT team!) would not know the key to the data.