Agree, good point, the overlay needs to do strong identity, authN, authZ.
The critical part the overlay adds to traditional auth is making the server unreachable from the underlay networks, reducing attack surface by billions. Meaning:
+ Let's say the server did have good auth, but there was a bug, misconfig, zero day, etc. (one of the myriads of proximate causes).
+ Since the server is available on the underlay network, that vulnerability can be exploited by anyone on the underlay (billions Internet nodes).
+ In contrast, making the server only available on the overlay, reduces the attack surface from billions of Internet nodes to the nodes which can ID, authN and authZ (for that particular server) on the overlay.
The critical part the overlay adds to traditional auth is making the server unreachable from the underlay networks, reducing attack surface by billions. Meaning:
+ Let's say the server did have good auth, but there was a bug, misconfig, zero day, etc. (one of the myriads of proximate causes).
+ Since the server is available on the underlay network, that vulnerability can be exploited by anyone on the underlay (billions Internet nodes).
+ In contrast, making the server only available on the overlay, reduces the attack surface from billions of Internet nodes to the nodes which can ID, authN and authZ (for that particular server) on the overlay.