ZTNA Should Be Everywhere: Why a Firewall-based Zero-trust Strategy Makes Sense for Hybrid Networks