Default deny
Also called: deny by default, allowlist firewall
Default deny is a security posture where everything is blocked unless explicitly permitted, so a forgotten service is closed rather than exposed.
Default deny blocks everything not explicitly allowed. Its opposite, default allow, permits everything not explicitly blocked.
The difference shows up in what happens when you forget something. Under default allow, a service you did not think about is reachable. Under default deny, it is closed until you decide otherwise. One fails open, the other fails closed.
Applied to a firewall it means the inbound policy is DROP with a short allowlist. Applied to egress — which most systems skip — it also constrains what a compromised process can reach, which is what turns an air-gapped tier from a claim into an enforced property.
The cost is friction: every new service needs a rule. That friction is the point.