@GossiTheDog Completing my thought from earlier, Firewalls were introduced at a time when endpoints had zero security controls to protect themselves, but that is no longer the case. With the better capabilities of the endpoint and the rise of end-to-end encryption for everything (tunneling over 443/tcp, the only port on the Internet) it probably makes more sense to invest in endpoint management and distribute as much security tooling as possible with centralized _management_ rather than centralized _networking_. Like I think it makes a ton of sense to put security policy and auditing into a browser extention (like uBlock) than trying to MITM all the clients, and obviously any client which can be managed has a perfectly suitable packet filter built-in. I think you could use the complex firewalls only for devices that you can't closely manage (appliances, IoT, etc.) and try to simplify the overall network filtering to stateless ACLs, just to reduce the amount of obvious garbage the endpoints have to deal with.
I dunno, maybe when the rubber hits the road this is unworkable in practice, but I think there is room to rethink where security controls make sense, when we have strong SSO and endpoint protection capabilities.
