{"id":47012,"date":"2023-03-09T13:40:58","date_gmt":"2023-03-09T13:40:58","guid":{"rendered":"https:\/\/www.arimetrics.com\/glosario-digital\/sdp"},"modified":"2026-09-27T07:20:59","modified_gmt":"2026-09-27T07:20:59","slug":"sdp","status":"publish","type":"encyclopedia","link":"https:\/\/www.arimetrics.com\/en\/digital-glossary\/sdp","title":{"rendered":"SDP"},"content":{"rendered":"<p><strong>Definition:<\/strong><\/p>\n<p><img decoding=\"async\" class=\"alignright wp-image-80687 size-full\" src=\"https:\/\/www.arimetrics.com\/wp-content\/uploads\/2026\/09\/sdp-glosario-600.jpg\" alt=\"SDP\" width=\"300\" height=\"300\" srcset=\"https:\/\/www.arimetrics.com\/wp-content\/uploads\/2026\/09\/sdp-glosario-600.jpg 600w, https:\/\/www.arimetrics.com\/wp-content\/uploads\/2026\/09\/sdp-glosario-600-300x300.jpg 300w, https:\/\/www.arimetrics.com\/wp-content\/uploads\/2026\/09\/sdp-glosario-600-150x150.jpg 150w, https:\/\/www.arimetrics.com\/wp-content\/uploads\/2026\/09\/sdp-glosario-600-360x360.jpg 360w\" sizes=\"(max-width: 300px) 100vw, 300px\" \/><strong>An SDP<\/strong>, short for <em>Software-Defined Perimeter<\/em>, is a security architecture that limits connectivity among users, devices, and resources according to identity and access policies. Instead of exposing a service to the entire network, it establishes an authorized connection to a specific application or resource.<\/p>\n\n<h2>How an SDP works<\/h2>\n<p>The central principle is to <strong>verify before allowing a connection<\/strong>. Protected services do not respond in the usual way to devices that have not yet been authorized, reducing the information visible to network scans and attacks.<\/p>\n<p>An SDP architecture commonly separates the control plane, where decisions are made, from the data plane, which carries the authorized connection. Its main components are:<\/p>\n<ul>\n<li><strong>Client or initiating host:<\/strong> a component installed on or integrated with the device that requests access on behalf of the user.<\/li>\n<li><strong>SDP controller:<\/strong> validates identity and context, checks policies, and decides which resources each request may reach.<\/li>\n<li><strong>Gateway or accepting host:<\/strong> protects the application or service and accepts only connections enabled by the controller.<\/li>\n<li><strong>Identity system:<\/strong> provides authentication, groups, attributes, and other signals required to evaluate policy.<\/li>\n<\/ul>\n<p>Designs documented by the <a href=\"https:\/\/cloudsecurityalliance.org\/artifacts\/software-defined-perimeter\" target=\"_blank\" rel=\"noopener\">Cloud Security Alliance<\/a> may use prior authorization and techniques such as Single Packet Authorization to keep ports and services hidden before a requester is validated. <strong>The specific implementation can vary<\/strong> across products and environments.<\/p>\n<h2>Differences between SDP and VPN<\/h2>\n<p>A <a href=\"https:\/\/www.arimetrics.com\/en\/digital-glossary\/vpn\">VPN<\/a> creates an encrypted tunnel between a device and a network or service. In many corporate deployments, once the tunnel is established, the user gains connectivity to a network segment and other controls determine which destinations may be used.<\/p>\n<p>SDP takes a more granular approach: it <strong>authorizes connectivity to specific resources<\/strong> and can prevent the rest of the infrastructure from being visible. The user does not need to receive general access to the network hosting the application.<\/p>\n<ul>\n<li><strong>Access scope:<\/strong> a VPN commonly connects to a network or segment, while SDP tends to connect to authorized applications or services.<\/li>\n<li><strong>Exposure:<\/strong> an SDP can hide resources until preliminary verification is complete, whereas a VPN focuses on protecting the tunnel.<\/li>\n<li><strong>Policy:<\/strong> SDP evaluates identity, device, and context to form each connection; a VPN can also integrate identity controls and segmentation.<\/li>\n<li><strong>Coexistence:<\/strong> the technologies can be combined, and a properly configured VPN is not inherently insecure.<\/li>\n<\/ul>\n<h2>Relationship with Zero Trust<\/h2>\n<p>SDP is one way to apply zero-trust connectivity, but <strong>SDP and Zero Trust are not equivalent<\/strong>. Zero Trust is a broader security model covering identities, devices, applications, data, policies, and continuous monitoring.<\/p>\n<p>The zero trust architecture described by <a href=\"https:\/\/csrc.nist.gov\/pubs\/sp\/800\/207\/final\" target=\"_blank\" rel=\"noopener\">NIST<\/a> does not grant implicit trust based on network location or device ownership. Authentication and authorization take place before a session to a resource is established. An SDP can implement these principles at the connectivity layer through <strong>least-privilege access and policy-based decisions<\/strong>.<\/p>\n<p>Deploying one does not replace other controls. Endpoint protection, identity management, application security, activity logging, and incident response remain necessary. Controllers and gateways also require <strong>availability, protection, and monitoring<\/strong> because they participate in critical decisions and connections.<\/p>\n<h2>Access process<\/h2>\n<p>SDP access is built dynamically for each identity and resource. Although the flow depends on the implementation, it commonly follows these stages:<\/p>\n<ol>\n<li><strong>Request:<\/strong> the client contacts the control component without yet having connectivity to the protected application.<\/li>\n<li><strong>Verification:<\/strong> the system checks identity and may consider device posture, location, risk, or other attributes.<\/li>\n<li><strong>Authorization:<\/strong> the controller applies policy and determines which resource, protocol, and duration are appropriate for the request.<\/li>\n<li><strong>Configuration:<\/strong> the controller coordinates the client and gateway to enable an encrypted route limited to the approved service.<\/li>\n<li><strong>Monitoring:<\/strong> the session can be logged, reevaluated, and closed when conditions change or the policy is no longer satisfied.<\/li>\n<\/ol>\n<p>The result is <strong>a restricted connection instead of general admission to the network<\/strong>. This reduces lateral movement and the exposed attack surface, but its effectiveness depends on the quality of the identities, policies, and signals used for each decision.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>SDP is a security architecture that hides resources and authorizes specific connections. Learn how it works and how it relates to Zero Trust and VPNs.<\/p>\n","protected":false},"author":28,"featured_media":80689,"template":"","encyclopedia-tag":[1405],"class_list":["post-47012","encyclopedia","type-encyclopedia","status-publish","has-post-thumbnail","hentry","encyclopedia-tag-network-access"],"_links":{"self":[{"href":"https:\/\/www.arimetrics.com\/en\/wp-json\/wp\/v2\/encyclopedia\/47012","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.arimetrics.com\/en\/wp-json\/wp\/v2\/encyclopedia"}],"about":[{"href":"https:\/\/www.arimetrics.com\/en\/wp-json\/wp\/v2\/types\/encyclopedia"}],"author":[{"embeddable":true,"href":"https:\/\/www.arimetrics.com\/en\/wp-json\/wp\/v2\/users\/28"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.arimetrics.com\/en\/wp-json\/wp\/v2\/media\/80689"}],"wp:attachment":[{"href":"https:\/\/www.arimetrics.com\/en\/wp-json\/wp\/v2\/media?parent=47012"}],"wp:term":[{"taxonomy":"encyclopedia-tag","embeddable":true,"href":"https:\/\/www.arimetrics.com\/en\/wp-json\/wp\/v2\/encyclopedia-tag?post=47012"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}