Leaving the Perimeter

## The last line of a policy is a policy Any access policy — a firewall rule base, an identity-aware proxy's rule set, a ZTNA policy engine, a segmentation policy between zones — is an **ordered list of rules terminated by a catch-all**. The catch-all is the rule that matches when nothing above it did. It has no subject, no owner and usually no ticket behind it, and it is the complete access policy for every entity your organisation does not know it has. That is the whole point of this problem. Rules are written about things people know about. An entity in no catalogue is, by construction, never the subject of a rule. So the question "what is our policy for the integration appliance nobody owns?" has exactly one answer, and it was set years ago by whoever wrote the last line. ## The two defaults, and what each actually buys **Allow by default ("default permit").** Anything not explicitly denied gets through. The cost is invisible and continuous: - The unlisted entity is reachable, and nobody reviews it. Access reviews and rule-base audits walk the rules that exist; there is no rule to review. - An adversary who gets a foothold on an unlisted appliance, or who replays an old service credential belonging to one, inherits its reachability. Nothing in the policy distinguishes that traffic from the appliance's normal traffic, because the policy never described the appliance's normal traffic. - There is no expiry. A rule has a change ticket and often a review date. A catch-all has neither. **Deny by default ("default deny").** Anything not explicitly allowed is dropped. This is the posture every zero-trust programme is funded to reach — NIST SP 800-207 describes access as granted per-request to a named subject for a named resource, which only means anything if unnamed subjects get nothing. The cost is loud and concentrated: - Everything unlisted stops **at the same moment**, and "unlisted" is precisely the set you could not enumerate in advance. If you could have listed it, it would have had a rule. - The breakage is biased toward the oldest and least-understood things: the file-transfer account created in 2014, the internal app one partner's automation still calls, the appliance whose vendor contract lapsed. These are frequently the revenue-bearing ones, because they have been quietly working for a decade. - The failure is often at an unhelpful hour. Batch integrations run overnight; a partner's quarterly reconciliation runs on a date nobody in the room remembers. ## Why "just deny, obviously" is the answer that fails an interview A candidate who says "default deny, always" has stated the destination and skipped the problem. The interviewer is testing whether you understand that the default is not a technical preference — it is a **failure posture somebody has to accept**. Turning the catch-all to deny means telling a business that an unknown number of unknown integrations will fail on a known date. Turning it to allow means telling a security programme that the hole it was funded to close stays open. In many estates neither answer gets a signature, and the catch-all keeps whatever it had by inertia. The useful answer names both costs and then narrows the gap between them, rather than picking a side: | Move | What it buys | What it still costs | | --- | --- | --- | | Deny only the destinations you can defend | The most sensitive resources stop accepting unnamed subjects immediately | The rest of the estate is still default-allow | | Deny by default with a fast, expiring break-glass | Being wrong costs minutes, not a quarter | Somebody must staff the break-glass at 02:00 | | Record what the enforcement point sees before flipping | You learn some of the unlisted set | The recording window is itself an allow window | | Time-box allow as a dated, signed exception | The default now has a name and an expiry on it | Somebody has to sign, and may refuse | ## The direction of the claim Be careful what each fact proves. That an entity has never appeared in a deny log **does not prove it does not exist** — it may reach its destination on a path that never passes your enforcement point. That an entity appears in the allowed traffic **does not prove it is legitimate or owned**; it proves a request arrived and the catch-all matched. And a policy with no rule about a subject is not a policy of neutrality toward that subject: it is whichever default the last line carries, applied silently, to an entity nobody is watching.