Branch networks no longer behave like quiet extensions of a single headquarters LAN. They terminate local user traffic, break out directly to the internet for SaaS, maintain persistent connections back to core systems, and increasingly host devices that are operationally important even when central resources are unavailable. NIST notes that the enterprise network landscape has shifted because of cloud services, geographic dispersion, and changes in application design, while zero trust guidance emphasizes that network location is no longer the primary signal of trust.
In practice, that means a branch cannot be secured by treating the site-to-site tunnel as a blanket trust boundary. The branch edge has to make explicit policy decisions about which flows are allowed, which flows are encrypted, which flows are inspected, and which identities are entitled to touch which resources.
Read the original article: