Cybersecurity
The End of ‘Castle-and-Moat’ Architecture
For decades, corporate IT security was based on the castle-and-moat principle. The office network was the castle, protected by a thick wall (the firewall). Anyone outside the wall was not trusted, and everyone inside the wall had free rein. When working from home became the norm, companies built a virtual bridge across the moat: the VPN (Virtual Private Network). As soon as an employee connected via the VPN, they found themselves ‘inside the castle’ and often gained access to the entire corporate network. This model has proven catastrophic in the era of sophisticated ransomware and cloud migrations. A single compromised employee account via phishing is sufficient to hold the entire network hostage.
The industry is therefore switching en masse to a fundamentally different security model: Zero Trust. The core philosophy? “Never trust, always verify.” Trust nothing and no one, regardless of whether the user is at headquarters or in a coffee shop in Bali.
Principles of Zero Trust Architecture
Zero Trust is not a software product that you install, but an architectural framework. Where a VPN provides network access (Network-centric), Zero Trust Network Access (ZTNA) grants access exclusively to specific applications (Application-centric). When a marketing employee logs in, they only connect to the CMS and the marketing dashboards, while the rest of the network (including the HR and financial systems) remains literally invisible and inaccessible at the network level.
Moreover, access is not static. Zero Trust evaluates the context of the request in real-time. To grant access, the system checks the user’s identity (via Single Sign-On and MFA), the health of the device (Is the laptop equipped with the latest patches? Is the antivirus running?), the location, and the time. If the CEO logs in from an unknown laptop abroad without the required corporate certificates, access is ruthlessly blocked.
Microsegmentation and BeyondCorp
A crucial technical pillar of Zero Trust is microsegmentation. Whereas networks formerly consisted of large, flat VLANs, microsegmentation divides the network (often in the data center or the cloud) into microscopically small zones, sometimes down to the level of the individual virtual machine or container. This prevents ‘lateral movement’. Even if a hacker penetrates a specific web server, they cannot hop ‘sideways’ through the network to reach the database server, because host-level firewalls block all traffic that is not explicitly allowed.
This model was first pioneered on a large scale by Google in 2009 under the name ‘BeyondCorp’, after they themselves fell victim to the sophisticated Operation Aurora hack. Today, parties such as Cloudflare, Zscaler, and Microsoft (Entra) offer out-of-the-box ZTNA solutions that render classic VPNs obsolete and allow employees to work securely, faster, and frictionlessly. Learn more about robust network security at Computable.
Next: Infrastructure as Code (IaC): The Battle Between Terraform, OpenTofu, and Pulumi
