Fail-Safe Defaults
Fail-Safe Defaults: Principle whereby access is denied by default and granted only when explicitly permitted. This term is relevant to the assessment and design of modern security architecturesSecurity ArchitectureThe structured design of security controls, trust boundaries, data flows, and operational responsibilities. and should be applied within the specific technical and organizational context.
How it works and where it fits
Fail-Safe Defaults is a building block of security architecture that must be understood in its system and business context. Its intended objective, affected trust boundaries, prerequisites, and interaction with other controls are decisive. An isolated definition is therefore not sufficient for implementation or assessment.
Practical security relevance
Sound implementation assigns ownership, configuration, data sources, and verifiable success criteria. Assumptions and exceptions should be documented and changes controlled. Periodic testing shows whether the concept reduces risk in the actual environment or has merely been addressed as a formal requirement.
Related concepts
- Access ControlAccess ControlGoverns who is permitted to access specific systems, data, or functions.: Governs who is permitted to access specific systems, data, or functions.
- Least PrivilegeLeast PrivilegeGrants only the minimum permissions necessary for a specific task and timeframe.: Grants only the minimum permissions necessary for a specific task and timeframe.
- Defense in DepthDefense in DepthCombines multiple independent security controls to create layered protection.: Combines multiple independent security controls to create layered protection.
- HardeningHardeningReduces the attack surface through secure configuration and the deactivation of unnecessary functions.: Reduces the attack surface through secure configuration and the deactivation of unnecessary functions.