Tip: put an identity-aware proxy in front of internal apps so anonymous internet traffic never reaches the sign-in page
- Inventory apps whose login pages are reachable from the public internet with no prior authentication.
- Prefer an identity-aware proxy or similar gateway: drop anonymous traffic, require MFA, then allow only approved identities onto specific apps or endpoints.
- Segment at the identity layer so abuse of one account can be an automated suspension with a blast radius of one, rather than taking the whole service offline.
Sources: Pat Opet on X (Nov 7) · Opet follow-up on identity-aware proxies