>It's fundamentally much better to just harden every system and implement proper federated authentication Much better? Yes. More practical? No. Once you have

>It's fundamentally much better to just harden every system and implement proper federated authentication Much better? Yes. More practical? No. Once you have a network of more than 3 hosts, host security can quickly become difficult to maintain. This means not just keeping up to date on patches but auditing all your configurations and carefully reviewing applications and services. Every organization in the world has serious host security issues. For example, a company like Google has an excellent security team and presumably world class endpoint security, but there's almost no question that an attacker on some segment of their internal network would be able to pivot and take over hosts (the lateral movement would likely be noticed by their SOC, perhaps within an hour or less, but it would still be after-the-fact). Proper network segmentation and architecture makes most of those issues much less risky though, as it is much harder to actually get to any of those hosts.