A computer-implemented method for establishing a secure connection between computing systems , the computer-implemented method being performed by a computing system comprising one or more processors executing computer executable instructions for the computer-implemented method, and the computer-implemented method comprising: receiving, at the computing system from another computing system , a request that at least one specified function be initiated, the request including user credentials and a device claim that identifies the other computing system ; authenticating a user using the received user credentials; determining, based on the device claim, that the other computing system is a secure computing system that has been approved to initiate performance of the at least one specified function; and upon determining that the user has been authenticated and that the other computing system is approved to initiate performance of the at least one specified function, initiating performance of the at least one specified function at the computing system itself, wherein determining, based on the device claim, that the other computing system is a secure computing system that has been approved to initiate performance of the at least one specified function includes determining that the computing device comprises a secure workstation, and characterized in that determining that the other computing system comprises a secure workstation includes establishing an updating policy configured to ensure that the secure workstation is running up-to-date software patches, instantiating an application blocking service configured to ensure that only applications on a specified whitelist are allowed to be executed on the secure workstation, and establishing a networking policy that prevents at least some inbound network connections from reaching the secure workstation. receiving, at the computing system from another computing system , a request that at least one specified function be initiated, the request including user credentials and a device claim that identifies the other computing system ; authenticating a user using the received user credentials; determining, based on the device claim, that the other computing system is a secure computing system that has been approved to initiate performance of the at least one specified function; and upon determining that the user has been authenticated and that the other computing system is approved to initiate performance of the at least one specified function, initiating performance of the at least one specified function at the computing system itself, wherein determining, based on the device claim, that the other computing system is a secure computing system that has been approved to initiate performance of the at least one specified function includes determining that the computing device comprises a secure workstation, and characterized in that determining that the other computing system comprises a secure workstation includes establishing an updating policy configured to ensure that the secure workstation is running up-to-date software patches, instantiating an application blocking service configured to ensure that only applications on a specified whitelist are allowed to be executed on the secure workstation, and establishing a networking policy that prevents at least some inbound network connections from reaching the secure workstation. <EOS>