Perimeter security controls access primarily through network boundaries: firewalls, segmentation, VPN gateways, and location-based restrictions. The traditional model treats traffic inside the boundary as trusted and traffic outside it as untrusted, but cloud services, SaaS applications, mobile work, and external collaborators make that boundary unreliable. section 15.1
A perimeter-based access path
An internal reporting tool requires users to connect through the corporate VPN before viewing sensitive dashboards. This shortcut trusts network location even when identity and device-posture checks could make the same decision from anywhere. section 15.5.4
Location is a weak trust signal when users, devices, workloads, and services operate across many environments. Once an attacker enters the perimeter, implicit internal trust can also enable lateral movement across systems. section 15.1
Modern access decisions reduce perimeter dependence by:
- Replacing network-derived shortcuts with identity- and context-based authorization. section 15.5.4
- Removing unnecessary VPN requirements when identity and device-posture policies already apply. section 15.5.4
- Retaining network controls as supporting signals rather than primary gatekeepers. section 15.5.4
Figure 15.1 Why the perimeter model fails in modern environments. In the traditional model (left), a firewall defined a clear boundary, and anything inside the perimeter was implicitly trusted. In modern environments (right), cloud services, mobile work, SaaS applications, and external collaborators eliminate meaningful boundaries.
Compare the traditional firewall boundary with modern environments where cloud, SaaS, mobile work, and external collaboration eliminate a meaningful perimeter. section 15.1
