What is the basic idea of perimeter security, and what is it fundamentally unable to see?
"Only allow safe networks!" — a network-based system boundary separates inside from outside, with network addresses and protocol types used to tell actors and actions apart. What it cannot see is trouble hiding inside good-looking traffic.
* The border checks the envelope — so a forged address or a hostile payload inside an allowed protocol walks through. *
The era arrives with the 1980s and the spread of the internet. The design is simple and, for its time, effective:
- A network-based system boundary defines inside and outside.
- Firewalls and similar devices control the border.
- Network address and protocol type are the discriminators: an address stands in for "who", a protocol type stands in for "what kind of action".
Its two structural weaknesses followed quickly, and both come from the same root — the proxies it uses for identity and intent are weak:
- Network addresses are easily forged. An address is an assertion, not a proof, so "it came from inside" stops meaning "it is one of ours".
- Permitted protocols carry payload as well as content. An allowed protocol can transport malicious code just as happily as useful data. The border check passed; the danger went through inside it.
So the honest summary is the one the era itself arrived at: as long as you can ensure everything stays in its intended place in the network, and you install some contemporary improvements, perimeter security can be quite OK. Both halves of that sentence are conditions — and the first of them is exactly what mobile working, cloud services and connected partners have since destroyed.
Go deeper:
Wikipedia — Firewall (computing) — the generations of firewall, each answering the previous one's blind spot.- Wikipedia — DMZ (computing) — the classic perimeter pattern for services that must be reachable from outside.