As we move to the Cloud based business model we should also consider changing our Security Model closer to "Zero Trust".

Zero Trust - assume everything is on the open internet.

Here is the first (in the multi-part series) blog on the same subject from Microsoft - Identity and access management.

BTW, do you remember the statement "identity is the new perimeter", more and more people are beginning to agree with it

https://cloudblogs.microsoft.com/microsoftsecure/2018/12/17/zero-trust-part-1-identity-and-access-management