{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/perimeter-security","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/perimeter-security/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/perimeter-security/"},"term":{"en":"Perimeter security","da":"Perimetersikkerhed"},"aka":{"en":["perimeter defence","castle-and-moat security"],"da":["perimeterforsvar","borg-og-voldgrav-modellen"]},"domain":["security"],"cluster":"fundamentals","layer":"network","status":"current","summary":{"en":"Guarding the edge between an organisation's own network and the outside world, and trusting what is already inside.","da":"Beskyttelse af grænsen mellem organisationens eget netværk og omverdenen, hvor det, der allerede er indenfor, bliver betroet."},"body":{"formal":{"en":"A security model that places its main controls, such as a firewall and VPN, at the border of the internal network. Traffic is checked on the way in or out, while users and machines inside the border are largely trusted by default.","da":"En sikkerhedsmodel, der placerer de vigtigste kontroller, fx firewall og VPN, ved grænsen til det interne netværk. Trafik kontrolleres på vej ind og ud, mens brugere og maskiner inden for grænsen som udgangspunkt i høj grad er betroede."},"plain":{"en":"A castle with thick walls and one guarded gate - once you are past the gate, you can walk into almost any room.","da":"En borg med tykke mure og én bevogtet port - når du først er inden for porten, kan du gå ind i næsten alle rum."},"inPractice":{"en":"A municipality lets every office PC reach every server freely because they all sit behind the firewall, so one infected laptop brought in by an employee can reach the payroll system.","da":"En kommune lader alle kontorets computere nå alle servere frit, fordi de står bag firewallen, så en enkelt inficeret bærbar, som en medarbejder tager med ind, kan nå lønsystemet."},"whyItMatters":{"en":"With cloud services and remote work there is no longer one clear edge to guard, and an attacker who gets inside meets little resistance.","da":"Med cloudtjenester og hjemmearbejde er der ikke længere én klar grænse at bevogte, og en angriber, der først er kommet ind, møder kun lidt modstand."}},"deepDive":{"en":"Perimeter security is the architectural expression of the \"castle-and-moat\" trust model: a hardened boundary separates a trusted internal network from an untrusted outside, and the strength of the controls is concentrated at that boundary. The canonical components are a stateful firewall enforcing an allow/deny policy at the network edge, often segmented into a demilitarised zone (DMZ) that hosts internet-facing services between two firewall layers; a VPN concentrator terminating remote access; and increasingly a next-generation firewall or secure web gateway adding intrusion prevention (IDS/IPS), TLS inspection and application-layer filtering. NAT and private RFC 1918 addressing historically reinforced the model by making internal hosts unreachable from outside without explicit port forwarding.\n\nThe model's defining weakness is its implicit trust of anything inside the boundary: once past the firewall, a host typically enjoys broad east-west (lateral) reachability, so a single compromised endpoint - a phishing victim, an infected laptop, a supplier's connection - can move freely toward high-value systems. This is precisely the flat-network condition that lateral movement exploits, and it is why perimeter defence pairs poorly with modern threat models where initial access is assumed. Defence-in-depth was the traditional mitigation, layering internal segmentation, host firewalls and monitoring behind the edge so the perimeter is not the only line.\n\nThree structural shifts eroded the perimeter itself. Cloud and SaaS moved workloads and data outside the corporate network, so the assets to protect no longer sit behind the firewall; mobile and remote work (accelerated from 2020) moved users outside too, turning the VPN into a bottleneck and a single high-value target; and encrypted, API-driven traffic reduced what edge inspection can see. The result is that there is no longer a single, stable boundary to fortify - the perimeter has become the identity of each user and the security posture of each device.\n\nThe successor model is Zero Trust (NIST SP 800-207), which removes location-based trust and evaluates every request against identity, device state and context via a policy decision point, granting least-privilege access to one resource at a time. In deployment this is often delivered as ZTNA and, more broadly, SASE/SSE, which relocate the enforcement point from a datacentre edge to a cloud service near the user. It is a misconception that Zero Trust makes firewalls obsolete: perimeter controls remain useful as one layer of defence-in-depth (a compromised device is still better contained behind segmentation), but they can no longer be the primary trust boundary. Perimeter security protects a place; Zero Trust protects each transaction regardless of place.","da":"Perimetersikkerhed er det arkitektoniske udtryk for \"borg-og-voldgrav\"-tillidsmodellen: en hærdet grænse adskiller et betroet internt netværk fra et ikke-betroet ydre, og styrken i kontrollerne koncentreres ved den grænse. De kanoniske komponenter er en stateful firewall, der håndhæver en allow/deny-politik ved netværkskanten, ofte opdelt med en demilitariseret zone (DMZ), der huser internetvendte tjenester mellem to firewalllag; en VPN-koncentrator, der terminerer fjernadgang; og i stigende grad en next-generation firewall eller secure web gateway, der tilføjer intrusion prevention (IDS/IPS), TLS-inspektion og filtrering på applikationslaget. NAT og privat RFC 1918-adressering forstærkede historisk modellen ved at gøre interne værter uopnåelige udefra uden eksplicit port forwarding.\n\nModellens definerende svaghed er dens implicitte tillid til alt inden for grænsen: når man først er forbi firewallen, har en vært typisk bred east-west-rækkevidde (lateral), så et enkelt kompromitteret endepunkt - et phishing-offer, en inficeret bærbar, en leverandørs forbindelse - kan bevæge sig frit mod værdifulde systemer. Det er netop den flade netværkstilstand, lateral bevægelse udnytter, og derfor passer perimeterforsvar dårligt til moderne trusselsmodeller, hvor initialt fodfæste antages. Defence-in-depth var den traditionelle modforanstaltning, der lagde intern segmentering, host-firewalls og overvågning bag kanten, så perimeteren ikke er den eneste linje.\n\nTre strukturelle skift udhulede selve perimeteren. Cloud og SaaS flyttede arbejdsbelastninger og data uden for virksomhedsnetværket, så de aktiver, der skal beskyttes, ikke længere ligger bag firewallen; mobilt arbejde og hjemmearbejde (accelereret fra 2020) flyttede også brugerne ud og gjorde VPN'en til en flaskehals og et enkelt værdifuldt mål; og krypteret, API-drevet trafik reducerede, hvad kantinspektion kan se. Resultatet er, at der ikke længere er én stabil grænse at befæste - perimeteren er blevet den enkelte brugers identitet og den enkelte enheds sikkerhedstilstand.\n\nEfterfølgermodellen er Zero Trust (NIST SP 800-207), der fjerner placeringsbaseret tillid og vurderer hver forespørgsel ud fra identitet, enhedstilstand og kontekst via et policy decision point og giver least-privilege-adgang til én ressource ad gangen. I praksis leveres det ofte som ZTNA og mere bredt som SASE/SSE, der flytter håndhævelsespunktet fra en datacenterkant til en cloudtjeneste nær brugeren. Det er en misforståelse, at Zero Trust gør firewalls overflødige: perimeterkontroller er stadig nyttige som ét lag i defence-in-depth (en kompromitteret enhed inddæmmes stadig bedre bag segmentering), men de kan ikke længere være den primære tillidsgrænse. Perimetersikkerhed beskytter et sted; Zero Trust beskytter hver transaktion uanset sted."},"edges":[{"type":"requires","to":"cs/network","confidence":"high","strength":"normal"},{"type":"requires","to":"cs/firewall","confidence":"high","strength":"normal"},{"type":"contrasts-with","to":"security/zero-trust","why":{"en":"Perimeter security trusts whatever is inside the network; Zero Trust trusts nothing by location alone and checks every request.","da":"Perimetersikkerhed stoler på alt inden for netværket; Zero Trust stoler ikke på noget alene på grund af placering og kontrollerer hver forespørgsel."},"confidence":"high","strength":"primary"}],"depth":4,"sources":[{"title":"NIST SP 800-207 - Zero Trust Architecture","tier":"standard","publisher":"NIST"}],"draft":true}