> Users should log into applications, rather than networks, and enterprise applications should eventually be able to be used over the public internet.
Second with regards to this statement:
> Opening up your internal network to the internet and rely on every app to do security correctly is a ridiculously bad strategy.
That's precisely what zero trust networking is. Ala Google's BeyondCorp:
> Virtually every company today uses firewalls to enforce perimeter security. However, this security model is problematic because, when that perimeter is breached, an attacker has relatively easy access to a company’s privileged intranet. As companies adopt mobile and cloud technologies, the perimeter is becoming increasingly difficult to enforce. Google is taking a different approach to network security. We are removing the requirement for a privileged intranet and moving our corporate applications to the Internet.
(https://storage.googleapis.com/pub-tools-public-publication-...)
Maybe they're wrong about all this, but it's not anti-advice. It's a legitimate security model being pursued by many different companies.