Jason has set a firewall policy that allows only a specific list of network services and deny everything else. This strategy is known as a____________.

The "default deny" principle is a foundational security strategy for firewalls and access control systems. It dictates that any traffic or access request that is not explicitly permitted by a rule is automatically denied. This approach, also known as an implicit deny, minimizes the attack surface by ensuring that only known and approved services are accessible, blocking all other potential connections. It is a more secure posture than a "default allow" strategy, which permits all traffic except that which is explicitly forbidden.

A. Default allow is the opposite strategy, where all traffic is permitted unless an explicit rule denies it, which is considered insecure.
C. Default restrict is not a standard industry term for this security principle; "default deny" is the correct terminology.
D. Default access is ambiguous and not a standard term. Access can be either allowed or denied by default.

1. National Institute of Standards and Technology (NIST). (2005). Guidelines on Firewalls and Firewall Policy (Special Publication 800-41 Revision 1). Section 4.3.1, "Firewall Policy Approaches," p. 21. States that the most secure posture is to "deny all traffic, except for that which is explicitly permitted."

2. Saltzer, J. H., & Schroeder, M. D. (1975). The Protection of Information in Computer Systems. Communications of the ACM, 18(7), 398-402. Principle 8, "Fail-safe defaults," establishes the academic basis for denying access by default. DOI: https://doi.org/10.1145/361011.361062

3. Chapman, D. B., & Zwicky, E. D. (1995). Building Internet Firewalls. O'Reilly & Associates. Chapter 4, "Firewall Design," discusses the principle of "That which is not expressly permitted is prohibited."