SESK: Stuff Everyone Should Know · sesk.info/secplus-firewall-deny-by-default
What is it called when a firewall blocks all traffic that has not been expressly permitted?
Deny by default (default deny): only explicitly allowed traffic gets through.
- Allow by default
- Promiscuous forwarding
- Deny by default ✔
Why: A deny-by-default rule set starts closed and opens only the ports and hosts the business needs. It is safer than blocking just the known bad things. It also reduces unneeded traffic on the network.
Huh, didn't know that: NIST says deny by default should apply to outbound traffic as well as inbound.
My firewall is a strict bouncer: if you're not on the list, you're not getting in, even if you know the owner.
Like this card?
References
Answer: Deny by default. A deny-by-default rule set starts closed and opens only the ports and hosts the business needs. It is safer than blocking just the known bad things. It also reduces unneeded traffic on the network.
- NIST SP 800-41 Rev. 1, Guidelines on Firewalls and Firewall Policy nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-41r1.pdf
firewalls should block all inbound and outbound traffic that has not been expressly permitted
Checked 2026-10-10. - NIST SP 800-41 Rev. 1, Guidelines on Firewalls and Firewall Policy nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-41r1.pdf
deny by default is a more secure approach than permitting all traffic that is not explicitly forbidden
Checked 2026-10-10.
Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.
More stuff everyone should know
Security & PrivacyGiving each user only the access needed for their assigned tasks follows which principle?Security & PrivacyWhere do network designers commonly place public-facing web and email servers behind a firewall?Security & PrivacyEncrypting a laptop's files mainly protects which part of the CIA triad?
That's stuff everyone should know.