Perimeter Security vs Zero Trust: Trust Assumptions, Authentication Frequency and Remote Access Compared
Perimeter security trusts the inside of the corporate network and places firewalls and VPN appliances at the boundary with the internet to keep attacks out. Zero trust grants no trust based on network location; for each combination of user, device and resource, it checks every access and then allows only what is needed. The US NIST defines zero trust architecture in SP 800-207 (2020). Zero trust spread as cloud services and access from outside the office grew and the things to protect moved beyond the perimeter.
| Aspect | Perimeter security | Zero trust |
|---|---|---|
| Trust assumption | The inside of the corporate network is trusted and the outside is not | Network location confers no trust; access from inside is checked every time, just like access from outside |
| Where controls sit | At the boundary with the internet (firewalls, VPN appliances, proxies and so on) | On each access path between users or devices and resources (applications and data), with a point that decides whether to allow access (policy decision point) and a point that enforces the decision (policy enforcement point) |
| Timing of authentication and authorization | Once, when entering the corporate network (for example, when connecting to the VPN) | Per resource and per session, based on user authentication (such as multi-factor authentication), device state, location and time, and re-evaluated when conditions change |
| Remote access | A VPN connects users to the corporate network and treats them as if they were in the office | ZTNA (zero trust network access) and similar approaches connect users only to the applications they are allowed to use, never to the whole network |
| Lateral movement after a breach | Once inside, traffic between internal machines faces few restrictions, so an attacker can spread easily | Access is divided finely and only the necessary rights are granted (least privilege), so spreading is harder |
| Treatment of devices | Devices connected to the internal network tend to be trusted | Whether a device is managed and whether its OS updates and anti-malware are in order are used as inputs to every access decision |
| Visibility and logging | Traffic crossing the boundary is logged, but traffic between internal machines is hard to see | Every access request and decision is logged and used for continuous monitoring and for improving the policy |
| Fit with the cloud | As use of cloud services and access from home grow, the things to protect move outside the boundary; routing all traffic through the VPN into the office tends to congest links and appliances | Decisions follow the same policy regardless of location, which suits cloud services and remote work |
| Migration difficulty | Easy to understand, and most organizations already have it | Requires identity management, device management, an inventory of assets and a designed access policy, and is adopted step by step; installing a single product does not achieve it |
Figures are typical orders of magnitude and vary by process generation and product.