Which data flow direction is protected in a zero trust firewall deployment that is not protected in a perimeter-only firewall deployment?

A perimeter-only firewall deployment focuses on inspecting "north-south" traffic, which is data entering (inbound) or exiting (outbound) the network boundary. This model operates on the principle that everything inside the perimeter is trusted. In contrast, a Zero Trust architecture assumes no implicit trust and mandates verification for all access requests, regardless of origin. This requires inspecting "east-west" traffic—the lateral communication between servers, applications, and segments within the network perimeter. Protecting this internal east-west traffic flow to prevent lateral movement of threats is a core tenet of Zero Trust that is absent in a perimeter-only model.

A. outbound: Outbound traffic is a component of north-south traffic, which is the primary focus of protection in a perimeter-only firewall deployment.
B. north south: This traffic flow, encompassing both inbound and outbound data, is the explicit domain of traditional perimeter-only firewalls.
C. inbound: Inbound traffic is a component of north-south traffic and is the fundamental flow that perimeter-only firewalls are designed to inspect and secure.

1. Palo Alto Networks

"What Is East-West Traffic?" (Technology Page). "Traditional security focuses on north-south traffic

which is traffic that moves in and out of a data center... However

this leaves east-west traffic vulnerable... A Zero Trust security model helps secure east-west traffic by using microsegmentation to create secure zones in data centers and cloud deployments."

2. NIST Special Publication 800-207

"Zero Trust Architecture"

September 2020. Section 3.1.2

"Micro-segmentation

" describes a key Zero Trust approach: "This is the case for micro-segmentation

where the enterprise places security components (such as an agent on an asset or a gateway) to protect a given workflow or even a single asset. This allows the enterprise to have policies that restrict traffic and access between components." This control of internal traffic is the essence of protecting east-west flows.

3. Palo Alto Networks

"The Zero Trust Enterprise" (White Paper). Page 4

"Secure the Network

" states: "Zero Trust requires organizations to secure their east-west traffic through segmentation. This is a fundamental shift from the traditional perimeter-based security model

which focuses on north-south traffic."