Trust Boundaries¶

Security posture changes at boundaries between different trust levels; all data crossing boundaries must be treated as potentially hostile until validated.

Tension Addressed¶

Convenience vs. Safety

Recognizable As¶

Firewalls at network perimeters; input validation at API boundaries; deserialization boundaries; service-to-service authentication; user input sanitization; iframe sandboxing. Any point where control transfers between entities with different trust levels.

Canonical Sources¶

Shostack, "Threat Modeling: Designing for Security" (2014)

Transfers To¶

Organizational boundaries (vendors, partners), physical security (perimeters), distributed systems (service boundaries), API design (external vs. internal APIs)

Trust boundaries are not about trusting or distrusting - they mark where your assumptions about data validity change and where validation must occur.