Enterprise Firewall Policy Design in Practice: From Default Deny to Business Whitelists

Default Deny Is Not a Slogan; It Is the Factory Setting of Every Device

In the server room of a cross-border e-commerce company in Beijing, we once witnessed the most typical “permissive policy” disaster. It was a fast-growing company of 80 people. For convenience, the IT manager simply added an “Any to Any” allow rule to the firewall policy, calling it “ensuring business continuity.” Three months later, ransomware came in through an attachment in a foreign trade email, encrypted the core order database, and caused losses of up to RMB 450,000. This painful lesson tells us that the foundation of a firewall must be “default deny.” This is not the arrogance of technicians, but reverence for business security. A true security policy should work like the moat of the Forbidden City in Beijing: by default, all flow is blocked, and only data packets holding a specific “pass” may get through.

Implementing default deny is not achieved overnight; it requires treating network traffic as “presumed guilty.” In companies with 50 to 100 employees, business functions are relatively concentrated, typically covering OA office systems, email, ERP, and some external-facing web services. We do not blindly allow everything; instead, we first block all unnecessary inbound and outbound traffic. For internal employees accessing the internet, we open only basic web services such as HTTP/HTTPS and block internet access on high-risk ports such as 445 and 3389. This “whitelist” mindset requires operations staff to know the business architecture inside out: who accesses what, and when. This is not just firewall configuration; it is a thorough health check of the company’s business processes.

Layered Policies and Business Whitelists: Building a Security Net Block by Block

Many small and medium-sized enterprises take a one-size-fits-all approach to firewall configuration, piling every rule onto the perimeter firewall. The result is a bloated policy set and even conflicting rules. In Siwenlide’s service framework, we favor a layered policy design that divides the security perimeter into three tiers: perimeter, zone, and host. Take a 60-person manufacturing company as an example: we divide the network into an office zone, a production zone, a server zone, and a guest zone. The perimeter firewall blocks external attacks, inter-zone firewalls control lateral movement between departments, and host-level policies serve as the last line of defense. With this architecture, even if an attacker breaches the perimeter, they cannot move freely through the internal network.

Defining the business whitelist is the core of this work. We need to work closely with business departments to establish that Finance can access only specific ERP ports, R&D can reach the code repository but must never access unknown download sites, and guest Wi-Fi can only reach the internet with strictly no access to internal resources. As part of the IT Operations Outsourcing services Siwenlide provides, we help clients map out this “business passport.” Network Equipment Package is not just about providing hardware; it also includes ongoing optimization of this policy set. Through layered control, we isolate risk into the smallest possible units, ensuring that even if one zone falls, it does not trigger an avalanche. This kind of fine-grained management is a valuable asset built up over 14 years of experience.

Log Auditing and Anti-Patterns: Don’t Let Security Go Blind

Many companies deploy a firewall and then overlook the importance of log auditing, or simply disable logging to save storage space. This is a serious misconception. Without logs, a firewall loses its “eyes”; when something goes wrong, you cannot even trace the source. In companies with 50–100 employees, log auditing is not only a compliance requirement but also the key to spotting potential threats. We recommend retaining logs for at least 180 days and analyzing anomalous traffic on a regular basis. For example, if an office computer repeatedly tries to connect to external IPs at 3 a.m., it is very likely infected with a crypto-mining trojan, and the logs will raise the alarm immediately.

Against these common anti-patterns, we have summarized five pitfalls that must be avoided:

1. Overly broad policies: Avoid using “Any” as the source or destination address; be specific down to an IP range or even a single IP.
2. Wide-open ports: Do not open entire port ranges for convenience; open only the specific ports the business requires.
3. Neglecting updates: Firewall firmware and signature databases must be kept up to date, or new vulnerabilities cannot be defended against.
4. No drills: Regularly simulate attacks to test whether policies are effective, rather than regretting it after an incident.
5. Privilege abuse: Administrative privileges must be managed in tiers, so that no single person holds excessive rights and causes mistakes.

For companies seeking a higher level of security, we recommend adopting a zero trust architecture. Traditional perimeter defense struggles to cope with complex insider threats and remote work scenarios. Our sTrust Zero Trust Security solution continuously verifies identity and device status, embodying “never trust, always verify.” sTrust Zero Trust integrates seamlessly with existing firewall policies, adding an extra security moat for critical business. In 14 years of practice, we have seen too many companies pay a heavy price for overlooking details. Security is no small matter; every policy optimization reinforces the company’s assets.