CANDY SECURITY A term coined by Bellovin and Cheswick of Bell Labs to describe a security scenario where the outer perimeter, such as a firewall, is strong, but the infrastructure behind it is weak. The term refers to M&M candy, which has a hard outer shell and soft center.