# What is a Software-Defined Perimeter (SDP)?

> A software-defined perimeter (SDP) is an access architecture that limits network connectivity to explicitly authorized resources.

- Canonical URL: https://yellowcube.eu/glossary/software-defined-perimeter/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

Instead of making a protected service ordinarily reachable and then filtering attempts, an SDP system authenticates the requesting identity, evaluates device and contextual signals, and authorizes a specific connection before permitting the requester to reach that service.

An SDP commonly uses a policy controller plus initiating and accepting hosts or gateways. After approval, the enforcement components establish an encrypted path exposing only the allowed application or service — not the surrounding network. This reduces unsolicited discovery and ambient reachability, but “invisibility” is an imprecise marketing shorthand: controllers, gateways, endpoints, and permitted services still have observable and attackable surfaces.

### Key points

- **Access decision:** A requester supplies identity, device, and contextual evidence to an authorization component, which evaluates policy before granting narrowly scoped connectivity.
- **Enforcement:** Initiating and accepting hosts or gateways restrict the permitted path to approved services and can conceal other addresses and ports from ordinary discovery.
- **Lifecycle:** Designs may use single-packet authorization, mutual authentication, short-lived credentials, segmentation, or continuous reassessment; the specific mechanisms vary.
- **Important limitation:** An SDP does not make an unsafe application, compromised endpoint, weak identity process, or poorly protected controller secure. Availability and security depend heavily on the policy, control, and enforcement components, while an authorization decision can become stale as risk changes.

### Related terms

[Zero trust architecture (ZTA)](<https://yellowcube.eu/glossary/zero-trust-architecture/>) · [Zero trust network access (ZTNA)](<https://yellowcube.eu/glossary/zero-trust-network-access/>) · [Network segmentation](<https://yellowcube.eu/glossary/network-segmentation/>) · [Microsegmentation](<https://yellowcube.eu/glossary/microsegmentation/>) · [Authentication](<https://yellowcube.eu/glossary/authentication/>)

### Sources

[Cloud Security Alliance: Software-Defined Perimeter Architecture Guide V3](https://cloudsecurityalliance.org/artifacts/software-defined-perimeter-architecture-guide-v3) · [NIST SP 1800-35: Implementing a Zero Trust Architecture](https://csrc.nist.gov/pubs/sp/1800/35/final)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.