A deny-by-default security posture must be implemented for traffic entering and leaving the enclave.

To prevent malicious or accidental leakage of traffic, organizations must implement a deny-by-default security posture at the network perimeter. Such rulesets prevent many malicious exploits or accidental leakage by restricting the traffic to only known sources and only those ports, protocols, or services that are permitted and operationally necessary.

Applications, protocols, TCP/UDP ports, and endpoints (specific hosts or networks) are identified and used to develop rulesets and access control lists to restrict traffic to and from an enclave.

Determine if a deny-by-default security posture has been implemented for both inbound and outbound traffic on the perimeter router or firewall.

If a deny-by-default security posture has not been implemented at the network perimeter, this is a finding.

Implement a deny-by-default security posture on either the enclave perimeter router or firewall.