Perimeter security

Perimeter security is the architectural expression of the "castle-and-moat" trust model: a hardened boundary separates a trusted internal network from an untrusted outside, and the strength of the controls is concentrated at that boundary. The canonical components are a stateful firewall enforcing an allow/deny policy at the network edge, often segmented into a demilitarised zone (DMZ) that hosts internet-facing services between two firewall layers; a VPN concentrator terminating remote access; and increasingly a next-generation firewall or secure web gateway adding intrusion prevention (IDS/IPS), TLS inspection and application-layer filtering. NAT and private RFC 1918 addressing historically reinforced the model by making internal hosts unreachable from outside without explicit port forwarding.

The model's defining weakness is its implicit trust of anything inside the boundary: once past the firewall, a host typically enjoys broad east-west (lateral) reachability, so a single compromised endpoint - a phishing victim, an infected laptop, a supplier's connection - can move freely toward high-value systems. This is precisely the flat-network condition that lateral movement exploits, and it is why perimeter defence pairs poorly with modern threat models where initial access is assumed. Defence-in-depth was the traditional mitigation, layering internal segmentation, host firewalls and monitoring behind the edge so the perimeter is not the only line.

Three structural shifts eroded the perimeter itself. Cloud and SaaS moved workloads and data outside the corporate network, so the assets to protect no longer sit behind the firewall; mobile and remote work (accelerated from 2020) moved users outside too, turning the VPN into a bottleneck and a single high-value target; and encrypted, API-driven traffic reduced what edge inspection can see. The result is that there is no longer a single, stable boundary to fortify - the perimeter has become the identity of each user and the security posture of each device.

The successor model is Zero Trust (NIST SP 800-207), which removes location-based trust and evaluates every request against identity, device state and context via a policy decision point, granting least-privilege access to one resource at a time. In deployment this is often delivered as ZTNA and, more broadly, SASE/SSE, which relocate the enforcement point from a datacentre edge to a cloud service near the user. It is a misconception that Zero Trust makes firewalls obsolete: perimeter controls remain useful as one layer of defence-in-depth (a compromised device is still better contained behind segmentation), but they can no longer be the primary trust boundary. Perimeter security protects a place; Zero Trust protects each transaction regardless of place.