Why perimeter security no longer protects critical infrastructure
According to the ENISA Threat Landscape 2025, 53.7% of all cyber incidents occur in sectors defined as essential entities. This confirms that relying solely on a perimeter security model is a vulnerability in a protection strategy. Modern attack vectors often target lateral movement within the network, where network access control lists (ACLs) can no longer provide protection once the external barrier is breached. The Cisco Cybersecurity Readiness Index 2025 highlights Identity Intelligence and Network Resilience as critical pillars for modern cyber resilience.
CISA CPG 2025: from network segmentation to data granularity
CISA CPG 2025 requirements emphasize the need to shift from static network restrictions to architectural access control. A key task for a CISO is to minimize the "blast radius" in the event of an account compromise. This is achieved through logical segmentation, where access rights are tied to specific business objects rather than just network segments.
Architectural isolation of business logic: RLS and ABAC
Practical implementation of modern security includes:
- RLS (Row-Level Security): limiting access to specific database records, allowing users to see only data relevant to their department.
- ABAC (Attribute-Based Access Control): dynamic granting of rights based on context (e.g., IP address, access time, or operation criticality).
- Physical isolation (on-premises deployment): for critical control nodes, allowing sensitive business logic to be separated from external cloud risks, in accordance with AWS Telco Lens recommendations for building reliable workloads.
The role of the UnityBase platform in ensuring access control
The UnityBase platform, developed by the Intecracy Group alliance, provides tools for implementing these requirements at the system core level. Using the Domain metadata model allows for integrated descriptions of data, APIs, and security rules (RLS, ACL, RBAC). Solutions built on UnityBase enable the implementation of attribute-based access directly into the application's business logic, which is critical for ensuring auditability and stability in enterprise environments. For systems with heightened security requirements, the use of Enterprise or Defence commercial editions is recommended.
On-premises vs cloud: an architectural choice
Infrastructure selection should be based on a risk profile. A hybrid approach, where sensitive data and business logic reside in an isolated on-premises environment while external services operate in a secure cloud, allows for balancing flexibility with regulatory compliance. This architecture provides the multi-layered protection required for modern networks, as described in ETSI reviews regarding mobile technologies.
FAQ
How does RLS help reduce the blast radius during a cyberattack?
RLS limits data visibility at the level of individual database records. If an account is compromised, the attacker only gains access to data covered by the user's permissions, rather than the entire database.
Which CISA CPG 2025 requirements are critical for the enterprise?
Key requirements include implementing the principle of least privilege, enhanced identification (Identity Intelligence), and transitioning to architectural segmentation that extends beyond network firewalls.
How does network-level segmentation differ from business-logic-level segmentation?
Network segmentation controls traffic flows, whereas business-logic-level segmentation manages specific user actions regarding data and operations within the application.