What is fail-closed?
Fail-closed describes a security control that blocks everything when it fails. If a firewall loses power, nothing crosses it. If a sign-in service cannot reach its MFA provider and is set to fail closed, nobody signs in until the provider returns. If a fail-secure electric strike loses power, the door stays locked from the outside. Fail-secure is the usual name for the same idea, especially for physical locks. The trade-off is the reverse of fail-open: confidentiality and integrity are protected throughout the failure, and availability is what gets lost.
Where fail-closed is the right choice
- Boundaries around sensitive data: a firewall in front of a cardholder data environment or a restricted research network, where uninspected access is worse than downtime.
- Authentication and authorization: access checks in code, privileged sign-in and admin consoles should deny when they cannot complete.
- Secure rooms: server rooms, data center cages, evidence rooms and pharmacy stock use fail-secure locks. A mechanical lever or push bar on the inside keeps free exit, because fire codes generally require that people can always get out.
- Default-deny rule sets: a firewall or ACL that ends with an implicit deny fails closed by design for any traffic nobody anticipated.
Firewalls tend to fail closed by nature: they route traffic, so a dead firewall forwards nothing.
Example: an MFA outage for administrators
An organization's cloud MFA provider goes down on a Saturday. The sign-in policy for administrator accounts is fail-closed: no password-only admin sign-in, ever. To keep the business recoverable, two break-glass accounts protected by hardware security keys that do not depend on that provider are sealed in a safe, monitored so any use raises an alert, and tested every quarter. The outage costs a few hours of admin convenience instead of opening a path that anyone holding a phished admin password could walk through.
Making fail-closed survivable
A control that fails closed turns every failure into an outage unless the design plans for it:
- Deploy critical firewalls and gateways as high-availability pairs, so one unit can fail while the other keeps enforcing.
- Remove single points of failure in whatever the control depends on, such as RADIUS servers, certificate revocation checks and license servers.
- Keep documented break-glass procedures for identity systems.
- Monitor health so failures are fixed in minutes, and test failover during maintenance windows.
Fail-closed vs. fail-open
Fail-open passes traffic when the control breaks and favors availability; fail-closed blocks traffic and favors protection. Neither is right everywhere. Inline devices, such as firewalls, IPS appliances and proxies, force the choice because traffic depends on them. A passive sensor on a tap or mirror port does not, since its failure only costs visibility. For doors, life safety overrides asset protection: exit paths use fail-safe locks that release, and fail-secure locks are acceptable only where people can still leave freely.
Fail-closed on the CompTIA Security+ exam
Failure modes fall under architecture decisions in SY0-801 objective 3.2, and the fail-open or fail-closed setting of an inline IPS comes up again with network mitigating controls in objective 4.1. Choose fail-closed or fail-secure when the scenario says no unauthorized access may occur even during a failure, or puts protecting sensitive data ahead of uptime. If it stresses that operations or patient care must continue, the answer is fail-open, and if people must be able to exit during a power loss, it is fail-safe. A scenario that wants both protection and uptime points to redundancy, such as a high-availability pair, rather than either failure mode alone.