Comparison
East-west trafficvsZero-trust networking
East-west traffic
one internal service calling another, which is most of your packets and historically none of your authentication.
Traffic between services inside the boundary. In a microservice estate it dwarfs the north-south volume, and it was traditionally unauthenticated and unencrypted on the assumption that the network was trusted. Making it verified — workload identity, mutual TLS, per-call policy — is precisely what a service mesh and a zero-trust posture are for, and it is why anything compromised inside the perimeter used to be able to reach everything.
Full entry →Zero-trust networking
being inside the network gets a caller nothing; every call is authenticated and authorised on its own merits.
Designing on the assumption that the network is hostile, so location confers no privilege and each request carries and proves identity. It is the answer to the flat internal network where one compromised host reached everything. In practice it is workload identity plus mutual TLS plus per-call authorisation, and the hard part is never the cryptography — it is enumerating who is allowed to call what, which nobody has written down.
Full entry →