Part 1 traced the firewall from stateless packet filters through NGFWs — four generations, each one built to close the previous generation’s blind spot. This part covers what happened once there was no longer a single perimeter to defend at all.

Why the perimeter dissolved

Distributed workforces and the migration of enterprise workloads to AWS, Azure, and GCP broke the assumption that a firewall lives on a rack in a data center. Modern architectures decouple security from any specific hardware appliance and embed it directly into the network fabric itself.

SASE and Firewall-as-a-Service

Secure Access Service Edge (SASE) converges SD-WAN networking with cloud-delivered security into one distributed service. Firewall-as-a-Service (FWaaS) is the core of that cloud perimeter — elastic Layer 3–7 policy enforcement, delivered from the cloud rather than a box.

                          SASE ARCHITECTURE (SIMPLIFIED)

  Remote Offices ─┐
  Branch Campuses ─┼──►  SASE CLOUD PERIMETER
  Mobile Endpoints ┘         │
                              ├── FWaaS  (L3–L7 edge enforcement)
                              ├── ZTNA   (identity-based access)
                              └── CASB   (SaaS application guard)
                                    │
                                    ▼
                    ENTERPRISE BACKEND WORKLOAD POOLS
              (hybrid data centers · AWS/Azure/GCP · SaaS apps)

Zero Trust Network Access (ZTNA)

Traditional firewalls trusted implicitly: authenticate once behind the corporate LAN or VPN tunnel, and you had broad network visibility from there. ZTNA replaces that with three operating principles:

  1. Assume breach — treat every connection as potentially hostile, regardless of where it originates.
  2. Explicit verification — continuously authenticate using MFA, device compliance posture, geolocation, and time-of-day signals, not a one-time login.
  3. Least privilege access — microsegment the network so a connection only reaches the specific application it needs, with no lateral visibility beyond that.

The practical effect: even if an attacker compromises one identity or device, ZTNA is designed to stop that compromise from turning into free movement across the network.

Policy as Code

In cloud-native environments, hand-configuring firewall rules through a GUI has largely given way to GitOps. Rule bases get authored as YAML or JSON, checked into version control, and reviewed like any other code change.

When a workload updates, its corresponding firewall policy gets evaluated through CI/CD test gates and provisioned automatically via Terraform or Ansible — the same review discipline you’d apply to application code, applied to network security policy.

Why this matters for security teams

SASE and ZTNA aren’t just buzzwords replacing “VPN” and “firewall” — they represent a real shift in trust model, from “inside the network = trusted” to “nothing is trusted until it’s continuously verified.” If your team is still writing firewall rules manually through a GUI, Policy-as-Code is worth prioritizing before your rule base becomes unauditable at scale.

Next in this series: how AI cuts both ways here — as a defensive capability inside the firewall, and as an entirely new class of workload the firewall has to learn to protect.

References

  • Cloud Security Alliance. “SASE Architecture Guidance.” cloudsecurityalliance.org
  • NIST SP 800-207. “Zero Trust Architecture.”
  • HashiCorp. “Policy as Code with Terraform.” hashicorp.com