east-west / north-south traffic

cloudnetworking

The two axes of data-center traffic: north-south crosses the perimeter to users; east-west flows between servers inside.

Microservices made east-west dominant - and made perimeter-only security obsolete.

North-south traffic crosses the boundary of your environment; east-west traffic moves between systems inside it. The terms come from how network diagrams are conventionally drawn, and the ratio between the two changed the security industry.

The classical model concentrated everything at the north-south boundary, because that was where the untrusted world was, and traffic inside the perimeter was assumed to be legitimate. Modern architectures inverted the proportions: microservices, virtualization and distributed storage mean the overwhelming majority of packets in a data centre never cross the boundary at all, and a perimeter control sees none of them.

That is the whole argument for microsegmentation and for zero trust as applied inside a network. An attacker who gets in has to move laterally to reach anything valuable, and lateral movement is east-west, which historically meant moving through the part of the network nobody was watching. Instrumenting and controlling east-west traffic is expensive and awkward precisely because it is high volume and internal, which is exactly why it went uncontrolled for so long.

← All glossary entries