Default Deny
A firewall posture in which nothing is permitted unless explicitly allowed, as opposed to blocking known-bad traffic.
The alternative — deny-listing — fails structurally, because it requires enumerating everything dangerous and there is always something you have not thought of. Allow-listing requires enumerating what is needed, which is finite and knowable.
Cloud security groups are default-deny for inbound by construction, which is why inbound is usually sound. Outbound is frequently left wide open, on the reasoning that traffic originating inside is trusted — and that is the gap through which exfiltration, command-and-control and SSRF operate.
Making outbound default-deny practical is the same method as microsegmentation: observe traffic first, build the allow-list from what actually communicates, then enforce. Guessing produces either an outage or a permissive policy that achieves nothing.
Reference other security groups rather than CIDR ranges where possible, so rules survive autoscaling.