Firewall expiry-by-default creates a quarterly renewal review nobody will fund, and each un-renewed permit stays an intruder's route in: what do you propose?

## Why the flat review is the wrong thing to defend Expiry-by-default is correct as a mechanism and often wrong as a programme, because the version people first propose treats all permits alike: every rule expires quarterly, every rule is renewed by a human, and the resulting workload is charged to whoever owns the network. When the clinical directorate refuses to staff that, they are not being obstructive — they are refusing a badly shaped ask. Winning the argument starts with agreeing that a flat quarterly review of hundreds of permits should not be funded. ## Shrink the population that needs a human The permits differ enormously in what they cost if they are wrong. Rank them by blast radius, which you can derive from the rulebase itself rather than from anyone's memory: | Permit shape | Expiry | Renewal | | --- | --- | --- | | Lower-trust zone into a clinical VLAN, wide service range | Short | Named human, each time | | Cross-zone but narrow, single host and service | Medium | Named human, lightweight | | Same-zone, narrow | Long | Confirm-or-lapse, minimal effort | Done honestly this usually reduces "hundreds of quarterly reviews" to a few dozen decisions a year in the tier that actually matters. That is a number a service owner can carry, and it is the number you should be negotiating over — not the raw permit count. ## Put the renewal where a review already happens A renewal that needs its own meeting will be skipped. A renewal attached to a review that already exists will not. The vendor-support permit renews when the vendor's support contract renews; the project's temporary access renews at the project's stage gate; a clinical system's access is confirmed during its existing change board. You are not creating governance, you are borrowing it, and that argument is far easier to win than a new headcount. ## Make the default cheap in the direction you want The design goal is that doing nothing closes a permit and renewing is a small deliberate act, so the friction falls on whoever wants the access. Two details decide whether that survives contact with a hospital: - **Nothing on a clinical path lapses unannounced.** Enforcement is announced, windowed and rehearsed, or the first patient-visible interruption ends the programme permanently. The cost of that discipline is real and belongs in your proposal, not hidden in it. - **The emergency re-open is itself time-bound.** If re-opening at 02:00 produces another permanent permit, you have funded a treadmill that does not reduce exposure. The re-open path should make an expiry and a named person the easy default. ## Refuse the false choice, and name the third option Sometimes the answer is still no: no renewal effort, no expiry risk. That is not a stalemate, because there is a third position that costs nothing to operate — **a named senior owner accepts the standing exposure in writing, with a stated review date and a stated scope**. The value of this is not paperwork. It is that the risk moves to the person who is actually choosing to keep the permit, and it usually changes their answer: people who will not fund an hour of renewal work are often unwilling to sign a page saying they accept an open path from a vendor zone into a clinical VLAN for another year. What you must not do is let security absorb the decision by quietly renewing everything on the business's behalf. That converts an organisational risk decision into a technical maintenance task, hides the exposure from the people who could reduce it, and leaves the network team accountable for an outcome it does not control. ## What to actually propose in the room 1. Tiered expiry, with the numbers: how many permits fall into the tier that needs a human, and what that costs in hours per quarter. 2. Renewal folded into reviews that already exist, so no new forum is created. 3. A staged enforcement plan with announced windows and a rehearsed re-open, so the outage risk is bounded and visible. 4. For anything the business will not renew and will not let you close, a signed acceptance with an owner and a date. 5. One number reported afterwards: not rules deleted, but how many standing permits have no expiry and no named owner — trending to zero. ## The judgment being tested The interviewer is not looking for enthusiasm about expiry. They are looking for someone who understands that a control with an ongoing human cost is an organisational commitment, that the person who benefits from an exception should carry its cost, and that when funding is genuinely unavailable the professional move is to make the risk owned and visible rather than to quietly hold it yourself.