Trust boundary

A trust boundary is a line drawn on a data flow diagram where the level of trust changes, for example between the public internet and an internal network, or between a semi-trusted web tier and a trusted internal zone. It is sometimes called a security boundary.

Boundaries earn particular scrutiny because a crossing is a point where data arrives from somewhere less trusted, or leaves for somewhere less protected, and where assumptions that hold comfortably inside one zone stop holding. Marking the boundaries is what turns a plain architecture diagram into something a threat model can be walked across, which is why decomposition includes them rather than stopping at components and flows.

The boundaries a team draws also identify important parts of the system’s attack surface, though not all of it: exposed interfaces, administrative functions and physical access can sit inside a zone without crossing a drawn line. Applying STRIDE element by element then works out what could go wrong at each element.

Exam relevance: trust boundaries turn up in threat modeling scenarios, where beginning the analysis at the crossings is a useful ordering rather than a rule that excuses the rest of the diagram. Note that calling a zone trusted is a modelling convenience rather than a security claim: a zero trust approach challenges precisely that assumption, and treats the boundary as somewhere to verify rather than somewhere to relax.