fail open vs. fail closed
expressionsecuritynetworking
The design choice of what a control does when it breaks: allow everything through, or block everything.
A fire door fails open because life beats security; a vault fails closed for the opposite reason. Every inline control faces the same choice - an IPS that fails open keeps the business running but unprotected, while failing closed is safe and is also an outage. The right answer is a decision, never a default.
When a control cannot make a decision, it either allows the traffic or blocks it, and choosing between those is one of the most consequential design decisions in any security system. Fail open preserves availability, fail closed preserves the security property.
Neither is correct in general, which is what makes it a decision rather than a rule. A door lock that fails closed during a fire kills people; a door lock that fails open during a power cut is not a lock. In technology the same tension appears constantly: an authentication service that fails open lets everyone in, and one that fails closed stops the business entirely, and both outcomes have been serious incidents at large companies.
What matters is choosing deliberately, per control, and documenting the reasoning, because the default is usually whatever the implementer happened to code. The questions that decide it are what the failure allows an attacker to do, what it costs the organization per minute, and whether the failure is likely to be induced by an attacker specifically to trigger it. That last one is the subtle case: a control that fails open is a control an attacker will try to break rather than bypass.
Also known as: fail-safe vs. fail-secure, fail open, fail closed