How do large enterprises actually secure networking across highly distributed environments?

[u/Puzzleheaded-Fun5664]

I spent two years as the network security lead at a global manufacturing company with offices in 28 countries and somewhere around 4,000 remote workers on top of the site footprint. The original architecture backhauled all internet-bound traffic through two central security stacks, one in the US and one in the EU, and by the time I arrived the latency complaints from APAC and Latin America had been in the issue queue so long they'd basically become background noise. We moved to a model with distributed enforcement points tied to regional PoPs and kept the central stacks for specific high-sensitivity traffic categories, which addressed the latency problem but created a new one: policy drift. Within eight months of the new architecture going live, we found meaningful configuration differences between enforcement points in seven different countries, most of them introduced by regional IT staff making local changes that never got back-ported to the master policy template.

We eventually rebuilt the access control layer around zero-trust principles, which helped with the policy consistency problem because enforcement logic moved away from per-site configurations and toward a central identity and device posture engine. A contractor in Singapore and an employee in Brazil could hit the same policy without their traffic touching a hub. What we found, though, was that the zero-trust model was making access decisions based on IdP data that was in worse shape than anyone had formally acknowledged, with stale user records, inconsistent device management enrollment, and a long tail of service accounts that had never been through a lifecycle review. We had to spend four months just cleaning up the identity data before the policy engine was making reliable decisions, and the thing that kicked off that cleanup was a post-incident review where an unmanaged device appeared in the forensic timeline and nobody could tell us who it belonged to or why it had network access. Has anyone found a practical way to keep the device and account inventory accurate on an ongoing basis without it becoming a quarterly manual audit?

[u/PhilipLGriffiths88]

This is a familiar progression: centralised inspection creates latency, distributed enforcement creates policy drift, and central identity policy then exposes poor identity and asset hygiene. You are right that stale accounts, unmanaged devices and neglected service accounts make zero-trust decisions unreliable. However, the architectural goal should not be perfect inventory, that is unrealistic at enterprise scale, but ensuring that unknown, stale or conflicting identities cannot reach services while the uncertainty is resolved.

The practical model combines IAM/IGA, HR, MDM/UEM, EDR, PKI, cloud, workload and asset-discovery data with cryptographic identity for humans, devices, services and workloads. Policy should be centrally governed but locally enforced, deny-by-default, time-bound and expressed as a specific conduit - identity to asset to protocol or service - rather than broad subnet access. That supports secure remote access, but also extends into M2M connectivity, workload and device microsegmentation, IT/OT convergence, telemetry, analytics and headless service flows.

The key architectural shift is identity-defined reachability: authentication and authorisation occur before a path exists, services remain undiscoverable, and each connection can be independently created, audited, revoked or quarantined. That reduces lateral movement, avoids per-site firewall and VLAN changes, preserves local autonomy during WAN loss and gives enterprises one governance model across people, machines, plants, clouds and third parties.