Failure Modes
Understanding fail-open versus fail-closed configurations for security devices. Covers the security implications of device failure behavior, when to use each mode, and how to balance security with availability requirements.
Understanding Failure Modes
When security devices fail, they must choose: continue allowing traffic (fail-open) or block all traffic (fail-closed). This decision has profound implications for both security and availability.
Failure mode options: • Fail-open (fail-safe) — Device failure allows traffic to continue • Fail-closed (fail-secure) — Device failure blocks all traffic
In 2018, a major airline's firewall failure was configured to fail-open, allowing unrestricted traffic for several hours. While this maintained operations, it exposed their network to potential attacks during that window—a calculated business risk that prioritized availability over security.
The right choice depends on what's being protected and the business context. Security-critical systems typically fail-closed; availability-critical systems may fail-open.
Why This Matters for the Exam
Failure modes are tested on SY0-701 because every inline security device needs a failure plan. Questions cover when to use each mode and understanding the trade-offs.
Understanding failure modes helps with security architecture, disaster recovery, and risk management. The wrong failure mode can cause either security breaches or business outages.
The exam tests scenario-based decisions about which failure mode is appropriate.
Deep Dive
What Is the Difference Between Fail-Open and Fail-Closed?
When Should Each Failure Mode Be Used?
Use Fail-Open When:
| Scenario | Reason |
|---|---|
| Hospital network | Patient care requires connectivity |
| Emergency services | 911 systems must function |
| Life safety systems | Fire alarms must communicate |
| E-commerce during peak | Revenue loss exceeds risk |
Use Fail-Closed When:
| Scenario | Reason |
|---|---|
| Financial transactions | Security breach costs more than downtime |
| Classified networks | Data protection is paramount |
| Payment processing | PCI compliance requires protection |
| Critical infrastructure | Attack could cause physical harm |
How Do Different Security Devices Handle Failure?
Device Failure Behaviors:
| Device | Typical Default | Reason |
|---|---|---|
| Firewall | Fail-closed | Security boundary must hold |
| IPS (inline) | Configurable | Depends on environment |
| IDS (passive) | N/A | Not inline, no traffic impact |
| Load balancer | Fail-open | Availability focused |
| Proxy server | Fail-closed | Security inspection required |
| WAF | Configurable | Balance security/availability |
What Are Fail-Safe vs Fail-Secure in Physical Security?
These terms have opposite meanings in physical vs network security contexts:
Physical Security:
- •Fail-safe = Door unlocks when power fails (allows exit for fire safety)
- •Fail-secure = Door locks when power fails (keeps intruders out)
Network Security:
- •Fail-open ≈ Fail-safe (traffic flows)
- •Fail-closed ≈ Fail-secure (traffic blocked)
Physical Security Examples:
| Device | Fail-Safe | Fail-Secure |
|---|---|---|
| Emergency exit | Unlocks (egress) | N/A for exits |
| Server room door | N/A | Stays locked |
| Perimeter gate | Varies | Stays locked |
| Mantrap inner door | N/A | Stays locked |
How Do You Mitigate Failure Mode Risks?
For Fail-Open Systems:
| Mitigation | Purpose |
|---|---|
| Redundancy | Failover to backup device |
| Monitoring | Detect failure immediately |
| Automatic failover | Minimize exposure window |
| Incident procedures | Rapid response plan |
For Fail-Closed Systems:
| Mitigation | Purpose |
|---|---|
| High availability | Redundant devices |
| Hot standby | Immediate failover |
| Out-of-band management | Access when primary down |
| Change procedures | Prevent misconfiguration |
What Factors Determine Failure Mode Selection?
Decision Framework:
| Factor | Fail-Open | Fail-Closed |
|---|---|---|
| Data sensitivity | Low | High |
| Compliance requirements | Flexible | Strict |
| Availability SLA | High (99.99%+) | Lower acceptable |
| Recovery time | Can wait | Must be instant |
| Business impact of outage | Severe | Manageable |
| Security breach impact | Manageable | Severe |
How CompTIA Tests This
Example Analysis
Scenario: A hospital network has an inline IPS protecting both the patient records system and the life-critical monitoring systems in the ICU. The IPS experiences a hardware failure. How should the failure mode be configured?
Analysis - Fail Mode Decision:
Conflicting Requirements:
| System | Requirement | Ideal Fail Mode |
|---|---|---|
| Patient records | HIPAA compliance | Fail-closed |
| ICU monitors | Life safety | Fail-open |
The Problem:
- •Single IPS protecting both systems creates impossible choice:
- •Fail-closed: ICU monitors lose connectivity → patient safety risk
- •Fail-open: Patient records exposed → HIPAA violation
Proper Architecture Solution:
Implementation:
- 1.Segment networks by failure mode requirements
- 2.Life-critical systems: Fail-open with strong monitoring
- 3.Compliance systems: Fail-closed with high availability
- 4.Add redundancy to minimize actual failures
Additional Controls for Fail-Open Segment:
- •Immediate alerting on failure
- •Manual monitoring during outage
- •Rapid response procedures
- •Backup inspection capability
Key insight: When systems have conflicting failure mode requirements, the answer is segmentation—not choosing one mode for everything. Architecture should align failure modes with system requirements.
Key Terms
Common Mistakes
Exam Tips
Memory Trick
Fail-Open vs Fail-Closed:
"OPEN door lets people through" Fail-Open = Traffic flows through
"CLOSED door blocks people" Fail-Closed** = Traffic blocked
When to Use Which - "LIFE vs DATA":
Life safety systems → Fail-Open ICU monitors → Fail-Open Fire systems → Fail-Open Emergency services → Fail-Open
Databases → Fail-Closed Accounting systems → Fail-Closed Top secret data → Fail-Closed Access control → Fail-Closed
The Best Answer: "Redundancy Removes the dilemma" With HA, you don't have to choose—backup device takes over.
Physical Security Warning: "In physical security, safe means escape" Fail-safe door = UNLOCKS for fire evacuation (Opposite of network fail-safe/fail-open behavior)
Test Your Knowledge
Q1.A hospital's life-critical patient monitoring system is protected by an inline IPS. How should the IPS failure mode be configured?
Q2.A firewall protecting a payment processing system experiences hardware failure. What is the MOST appropriate failure mode for this environment?
Q3.What is the BEST solution when different systems require different failure modes?
Want more practice with instant AI feedback?
Continue Learning
Ready for the Exam?
See exactly where you stand on this concept and 182 others.
99% pass rate · Pass guarantee