Default-deny posture
Demonstrate that network, system, and application access controls implement a default-deny policy model where all traffic and actions are blocked unless explicitly authorized by documented rules.
Description
What this control does
Default-deny posture establishes network, application, and system access control policies that implicitly block all traffic, connections, or actions unless explicitly permitted by rule. This approach inverts traditional permissive models by requiring administrators to affirmatively allow each necessary flow or behavior. The control reduces attack surface by preventing unauthorized lateral movement, data exfiltration, and exploitation of overlooked services or ports. Implementation spans firewall rulesets, zero-trust network policies, application whitelisting, and API gateway configurations.
Control objective
What auditing this proves
Demonstrate that network, system, and application access controls implement a default-deny policy model where all traffic and actions are blocked unless explicitly authorized by documented rules.
Associated risks
Risks this control addresses
- Attackers exploit unmonitored or forgotten network pathways to move laterally across segmented environments
- Malicious insiders exfiltrate data through undocumented or implicitly permitted outbound connections
- Compromised workstations execute unauthorized applications or scripts that permissive policies fail to block
- Shadow IT services operate on non-standard ports without security review or monitoring
- Zero-day exploits traverse network segments due to overly permissive inter-VLAN or inter-subnet routing
- API endpoints accept unauthenticated requests because authorization logic defaults to allow rather than deny
- Legacy firewall rules accumulate over time, creating implicit allow conditions that bypass intended security architecture
Testing procedure
How an auditor verifies this control
- Obtain current firewall and network access control list (ACL) configurations from perimeter devices, internal routers, and cloud security groups
- Identify the implicit action defined when no explicit rule matches incoming traffic (examine default policy statements at the end of rulesets)
- Review application-layer gateway, web application firewall, and API gateway configurations to determine default behavior for unmatched requests
- Select a representative sample of user workstations and servers, then review host-based firewall policies and application control configurations
- Conduct live testing by attempting to establish network connections to non-production systems using uncommon ports and protocols not explicitly permitted
- Interview network and security engineers to confirm change management processes require explicit allow rules before new services are deployed
- Review firewall rule justification documentation to verify each permit statement corresponds to a documented business or operational requirement
- Validate that logging captures all denied traffic and that security operations regularly review blocked connection attempts
Where this control is tested