Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesTo secure applications across data centers and multiple clouds without slowing teams down, combine segmented network connectivity with identity-aware access controls for users, workloads, and services. Then choose enforcement points—such as cloud firewalls, gateways, ZTNA, SASE, or service-mesh components—to match the traffic they actually need to protect. No single product or control plane makes policy consistent everywhere by itself.
What consistent security means across hybrid and multi-cloud environments
Consistency does not require every environment to use identical technology. It means that the organization defines comparable security outcomes—who or what may communicate, with which services, under what conditions—and can apply and review those decisions wherever the application runs.
Network location alone is not a reliable basis for trust. NIST’s SP 800-207A, published September 13, 2023, describes identity-centered zero-trust access control for cloud-native applications across on-premises and multiple cloud locations. Its model considers application and service identity alongside user and network identity. That distinction matters when workloads move, applications span providers, or a request crosses a data-center boundary.
As the publication’s authors, Ramaswamy Chandramouli and Zack Butcher, write: “One of the basic tenets of zero trust is to remove the implicit trust in users, services, and devices.” The statement is part of a broader discussion of zero trust, not a promise that identity checks alone secure an application.
#1 Best Overall
Start with the traffic and trust relationships
Before choosing products, map where applications and data live, which identities use them, and which communications are necessary. This creates a practical basis for both network design and application policy.
- Workload locations: Record the data centers, cloud environments, regions, and network segments hosting each application component and dependency.
- Identities: Identify user identities as well as workload and service identities. Note how each is issued, authenticated, and managed across environments.
- Required flows: Document user-to-application, service-to-service, application-to-data, cloud-service, administrative, and site-to-site traffic that the business requires.
- Trust boundaries: Mark where traffic crosses organizational, provider, application, or sensitivity boundaries, and identify who owns the controls at each crossing.
- Policy and evidence: Define the access decision that should apply and what logs or other evidence operators need to review it.
Separate two questions in the design: how traffic can reach a destination, and whether a particular user or service is authorized to use it. Connectivity provides routes and boundaries; identity-aware application policy governs permitted communication. Treating one as a substitute for the other leaves gaps.
Rank #2
Build the design in layers
1. Establish connectivity and limit network exposure
Connect data centers and cloud networks using an approach suited to the required traffic and operating model. Segment networks so that a reachable destination is not automatically exposed to every connected system. Cloud-native firewalls, network virtual appliances, and other network controls can help define boundaries and inspect or restrict traffic, depending on the environment and architecture.
Connectivity and security are related but distinct. A working private connection between environments does not authorize every workload on either side to communicate. Conversely, an application policy cannot provide a route where no connectivity exists.
Recommended Free Tools
2. Make access decisions using identities and application context
Apply authorization to the user or service requesting access, rather than relying only on the source network. In cloud-native designs, possible enforcement building blocks include API gateways, sidecar proxies, and application identity infrastructure. NIST discusses these as implementation components; they are not universal requirements for every application.
Keep user access and workload communication distinct in the policy model. A workforce user connecting to an application, one service calling another, and an application reaching a managed cloud service are different flows and may need different identities, rules, and enforcement points.
Rank #4
3. Choose controls for the flows they cover
Use controls in combination where necessary. A cloud firewall can enforce network-level rules in its scope; ZTNA can control user access to applications; service-mesh components can apply identity and authorization to service-to-service traffic. SASE and SD-WAN address broader network and access patterns, but neither label guarantees that every workload flow or cloud-service interaction is covered.
How the main approaches fit together
NIST’s SP 800-215, published November 17, 2022, surveys approaches including firewalls, microsegmentation, ZTNA, SASE, and SD-WAN as parts of the modern enterprise network landscape. They operate at different layers and should be compared by scope, policy basis, enforcement point, and operational fit—not treated as interchangeable names for complete security.
| Approach | Typical scope | Policy basis and enforcement | Best fit and boundary to check |
|---|---|---|---|
| Network segmentation and firewalls | Network-to-network and selected workload flows | Network boundaries, addresses, and configured rules; enforced by cloud-native controls or network appliances | Useful for limiting exposure and controlling routes. Check whether application identity and service-level authorization are also needed. |
| Microsegmentation | More granular workload-to-workload communication | Policies applied around workloads or segments; implementation and enforcement depend on the chosen architecture | Can narrow lateral communication. Verify coverage across environments and how rules follow workload changes. |
| ZTNA | Often user-to-application access | User identity and access policy enforced through a gateway or related service | Useful for controlling workforce access to applications. Do not assume it secures all service-to-service or site-to-site traffic. |
| SASE and SD-WAN | Distributed users, sites, and network access patterns | A combination of network and security functions; exact policy and enforcement depend on the service or deployment | Consider when operating distributed connectivity and access together. Confirm which cloud, application, and workload flows are in scope. |
| Service mesh | Service-to-service communication for supported applications | Service identity and authorization enforced through mesh components such as proxies | Can support distributed zero-trust application patterns. Confirm compatibility, operational ownership, and how traffic to external or legacy endpoints is handled. |
| Cloud network virtual appliances | Traffic routed through an appliance in a cloud network | Network policy and inspection at the appliance, subject to the routing design | Can extend familiar network controls into cloud environments. Check routing, availability, and whether traffic paths actually traverse the appliance. |
For each candidate control, test the same five questions: Is the relevant flow in scope? Which identity or network attributes drive the decision? Where is enforcement performed? Who administers policy and reviews events? Does the approach fit the application pattern—lift-and-shift connectivity, hybrid services, or distributed cloud-native services?
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Use reference architectures as patterns, not universal blueprints
Google Cloud’s hybrid and multi-cloud reference architectures, last reviewed January 13, 2025, illustrate how connectivity can work alongside cloud firewalls, VPC Service Controls, and network virtual appliances. Its examples also describe service-mesh identity and authorization, including routing to on-premises or other-cloud services.
These are Google Cloud-specific patterns, not a neutral requirement or a complete design for every provider. Their useful lesson is architectural: combine connectivity, network controls, and application or service identity where each is appropriate. Map the equivalent capabilities and responsibilities in each environment rather than assuming one provider’s control plane governs the others.
Implement policy without blocking delivery
- Inventory applications and dependencies. Assign owners, record locations and data sensitivity, and map the user, service, and infrastructure flows each application needs.
- Define policy outcomes. State which identities may access which services and under what conditions. Distinguish user access from service-to-service and network connectivity rules.
- Choose enforcement points by flow. Use network controls for network boundaries, identity-aware gateways for relevant user access, and service-level controls where application communication requires them. Record gaps where a flow lacks an appropriate enforcement point.
- Connect and segment environments. Build only the required routes between data centers and cloud networks, then limit broad reachability with segmentation and network rules.
- Roll out changes in stages. Validate policies with application owners and logs before enforcing them broadly. Resolve dependencies and exceptions deliberately rather than leaving temporary broad access undocumented.
- Review as workloads change. Reassess identities, routes, and authorization when services move, are replaced, or add dependencies. Keep policy ownership and review responsibilities clear across provider and enterprise teams.
Common design mistakes to avoid
- Equating connectivity with authorization: A private link or network route does not establish that every reachable service should trust the caller.
- Relying only on network location: Location-based rules do not express which user, workload, or service is making a request.
- Assuming one tool covers every flow: A firewall, SASE service, ZTNA deployment, microsegmentation system, or service mesh has a particular scope. Check actual traffic paths and identities before treating it as comprehensive.
- Centralizing policy but ignoring operations: A unified view is useful only if policies, logs, and ownership integrate with provider-specific controls and existing environments.
- Applying identical rules without application context: Consistency means consistent security intent and review, not forcing unrelated services into the same access rule.
Sources and scope
The architecture guidance here draws on NIST SP 800-207A, published September 13, 2023; NIST SP 800-215, published November 17, 2022; and Google Cloud Architecture Center’s hybrid and multi-cloud reference architectures, last reviewed January 13, 2025. These sources support architectural patterns and categories, not a current comparison or endorsement of named vendors, products, prices, or partner services.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
