As we move to the Cloud based business model we should also consider changing our Security Model closer to "Zero Trust".

Zero Trust - assume everything is on the open internet.

Here is the first (in the multi-part series) blog on the same subject from Microsoft - Identity and access management.

BTW, do you remember the statement "identity is the new perimeter", more and more people are beginning to agree with it

https://cloudblogs.microsoft.com/microsoftsecure/2018/12/17/zero-trust-part-1-identity-and-access-management

"Token Binding" - New upcoming RFC Standard - Token binding makes cookies, OAuth access tokens and refresh tokens, and OpenID Connect ID Tokens unusable outside of the client-specific TLS context in which they were issued

It turns out that cookies and tokens can be used outside of the original TLS context in all sorts of malicious ways. It could be hijacked session cookies or leaked access tokens, or sophisticated MiTM. This is why the IETF OAuth 2 Security Best Current Practice draft recommends token binding,


Normally  tokens are “bearer” tokens, meaning that whoever possesses the token can exchange the token for resources, but token binding improves on this pattern, by layering in a confirmation mechanism to test cryptographic material collected at time of token issuance against cryptographic material collected at the time of token use. Only the right client, using the right TLS channel, will pass the test. This process of forcing the entity presenting the token to prove itself, is called “proof of possession”.


https://cloudblogs.microsoft.com/enterprisemobility/2018/08/21/its-time-for-token-binding/