I read the federal government’s Zero-Trust Memo so you don’t have to

> “Enterprise applications should be able to be used over the public internet.”

Isn’t exposing your internal domains and systems outside VPN-gated access a risk? My understanding is this means internaltool.faang.com should now be publicly accessible.

It's a different framing to get rid of figleafs. Everything has to be built so that it actually has a chance of being secure - if your state of mind is "this is exposed to the public internet", BS excuses like "this is only exposed to the TotallySecure intranet" don't work any more, because they don't work in the first place. Perimeter security only works in exceedingly narrow circumstances which don't apply - and haven't applied for a long time[1] - to 99.999 % of corporate networks.

[1] Perimeter-oriented security thinking is probably the #1 enabler for ransomware and lateral movement of attackers in general.

For anyone confused about the term "figleaf", I assume it's a reference to fig leafs being used by Renaissance artists to mask genitalia. So "things concealing the naked truth" approximately.

It's older than that: it's a biblical reference to Adam and Eve covering themselves.