Comparison
East-west trafficvsNorth-south traffic
East-west traffic
one internal service calling another, which is most of your packets and historically none of your authentication.
Traffic between services inside the boundary. In a microservice estate it dwarfs the north-south volume, and it was traditionally unauthenticated and unencrypted on the assumption that the network was trusted. Making it verified — workload identity, mutual TLS, per-call policy — is precisely what a service mesh and a zero-trust posture are for, and it is why anything compromised inside the perimeter used to be able to reach everything.
Full entry →North-south traffic
the traffic crossing the boundary between the outside world and your platform, which is the part that has a certificate and a WAF.
Traffic in and out of the system as a whole — users, partners, the public internet. It is the smaller volume and the more scrutinised: it is where authentication, TLS termination, rate limiting and DDoS protection are applied, and where an external load balancer sits. Drawing the distinction matters because controls designed for this direction are routinely assumed to protect the other one, and they do not.
Full entry →