Deny by default/allow by exception assumes that all traffic is potentially malicious or at least unwanted or unauthorized. Everything is prohibited by default. As benign, desired, and authorized traffic is identified, an exception rule grants it access to the network.
Allow by default/deny by exception assumes that most traffic is benign. Everything is allowed by default. As malicious, unwanted, or unauthorized traffic is identified, an exception rule blocks it.
Most security experts agree that deny by default/allow by exception is the more secure stance to adopt.
Answer the following question(s):
When would you use allow by default/deny by exception? Provide a rationale for your answer.
Full Answer Section
However, the allow by default/deny by exception stance is not without its risks. If a malicious packet does slip through, it could have a significant impact on the network. Additionally, this stance can make it more difficult to track down the source of a malicious attack.
Here are some examples of when you might use allow by default/deny by exception:
- A home network with a few computers and devices
- A small business network with a few employees
- A network that is used for research or development
- A network that is used for testing
It is important to weigh the risks and benefits of the allow by default/deny by exception stance before deciding whether or not to use it. If you are concerned about the security of your network, you should consider using the deny by default/allow by exception stance instead.
Here are some additional considerations when deciding whether to use allow by default/deny by exception:
- The size and complexity of your network
- The risk of malicious traffic
- The resources you have available to manage your security
- Your organization's security policies
Sample Answer
The allow by default/deny by exception security stance is typically used in environments where there is a lot of legitimate traffic and the risk of malicious traffic is relatively low. For example, this stance might be used in a home network or in a small business network.
The rationale for using this stance is that it is more efficient and easier to manage. By default, all traffic is allowed, so there is no need to create a rule for every type of legitimate traffic. This can save time and effort. Additionally, if a malicious packet does slip through, it is more likely to be detected and blocked because it will be the exception to the rule.