An auditor asks what your branch's destination-port ACL prevents — what is the honest sentence, and your evidence?

## The question behind the question An auditor asking "what does this control prevent?" is asking you to make a claim they can test. The failure mode is not being caught out; it is writing a claim broader than your evidence and then having to defend it later, usually during an incident. This leaf's chair is exactly that person: the one who has to say what the control does **not** stop. ## The honest claim, in one sentence > The outbound ACL restricts which protocol and destination-port combinations branch hosts may reach, denies everything else, and logs the denials. It makes no assertion about which application or which data crossed on a permitted combination. Everything defensible sits inside that sentence. Everything a weak write-up adds — "prevents data exfiltration", "blocks unauthorised applications", "ensures only web browsing leaves the site" — sits outside it and is not supported by anything the device does. ## What evidence exists, and what each piece proves | Artefact | What it proves | What it does not | |---|---|---| | The rule base as running | which pairs are permitted right now | that it matches the documented intent | | Change record for each permit | who added it, when, and for whom | that the reason still holds | | Deny counters and logs | attempts occurred on refused ports and were dropped | that no other attempt succeeded elsewhere | | Flow records for permitted flows | bytes and packets moved between two addresses on a port, and when | which application, and what the payload was | The direction of each claim matters. A deny log proves something was **attempted and refused**; the absence of deny entries proves nothing about the estate, only that nothing hit that rule. A flow record proves **bytes moved**; it carries no payload, so it can never say what they were. ## The residual, written down rather than implied The residual risk is one sentence too: traffic permitted on tcp/443 may be any application, including a service relocated onto that port or another session tunnelled inside a permitted flow, and the branch has no device on the path that could tell. Adding "we plan to inspect" is only honest if somebody has actually funded it — and for clients that pin their own certificate, inspection is unavailable regardless of funding, so at least part of that residual is permanent by construction. ## The compensating measures you can honestly list Each of these is real, and each costs something you should name in the same breath: - **Default-deny outbound with an explicit permit list**, so every permitted pair is a decision on record. The cost is an exception queue and the occasional blocked business tool. - **Destination scoping for anything that is not a user laptop.** Servers, printers and appliances should reach a named set of destinations on their permitted ports. The cost is maintenance, and someone blocked when the list is stale. - **Deny logging retained long enough to be useful**, since it is the only evidence stream the control produces. - **Periodic review of the permit list against who asked for it**, because the entries that nobody can explain are the ones that quietly widen the claim you made above. ## How to say it in the room Name the control, name its scope, name its limit, then offer the evidence. "It restricts reachable destination ports and logs refusals; here is the running configuration, the change record and the deny logs. It does not identify applications on permitted ports, and at this site nothing on the path could — that residual is recorded and owned." A candidate who says that has demonstrated the thing this whole subject is about: the port number in a permit rule is a claim the sender made, and a control that matches claims cannot certify facts. ## The wrong answers Claiming the ACL blocks unapproved applications is the first. The second is subtler: offering the permitted-side flow records as evidence that nothing bad crossed. They show volume and timing and nothing else, and presenting them as assurance is how a defensible control becomes an indefensible claim.