Summary
- A rule is useful only when its service, owner, evidence and review date remain known.
- Default denial works in practice when exceptions expire, changes are logged and rollback is tested.
A firewall permits or blocks traffic according to defined conditions. Its effectiveness therefore depends on rule quality more than product branding. Emergency openings, copied address ranges and obsolete applications can survive long after their purpose ends. Each exception should name a requester, destination, reason and expiry, with automated checks for drift and a person authorised to close it. The next useful evidence is a rule-removal exercise that proves the service still works—or identifies the hidden dependency before an attacker does.
