Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I am very confused with Trust Boundary. How does this work?
Do I draw a trust boundary in between the application tier and the web tier because my servers in the web tier has a higher chances of getting hacked? Or should I draw it in between my end user PCs and my web server?
Does it also mean that communication going through this must be validated and encrypted? Can I just do one of them?
When data crosses from one "system" to another, draw a trust boundary line. This would certainly be anyplace where data traverses a network interface, or passes between two processes.
Data entering from across a trust boundary indicates every place where the receiving systems need to validate the inbound data. Data crossing a trust boundary also means that you have identified a place where you should examine the security of the data. It doesn't mean you must encrypt or that you must authenticate, but as you analyze the connection for vulnerabilities, you may discover that encryption and/or authentication remediates the issues.
