Re: Negative Policies

[Pierangela Samarati <samarati@pinky.crema.unimi.it>]

> Later I realized the answer. Positive policies fail closed, negative
> policies fail open. Failing closed (default deny) is preferable for two
> related reasons. First is the general security practitioner paranoid view
> that good security means that things should only be allowed if explicitly
> specified.

negative policies fail open if negative authorizations is the only thind
you have (meaning you stick to the classical open policy of "i
support *only* negative authorizations and whatever i do not deny it is
allowed). i do not believe that this was ever the case in our discussion.

best
-p