What is fail-open?

What is fail-open?

Fail-open describes what a security control does when it stops working: it lets everything through. An intrusion prevention system that crashes keeps forwarding packets without inspecting them, a web filter that cannot reach its rating service allows uncategorized sites, and an exit door's magnetic lock releases when power is lost. The opposite behavior, blocking everything on failure, is fail-closed. Choosing between them is a deliberate trade within the CIA triad: fail-open preserves availability and gives up confidentiality and integrity protection for as long as the control is down.

Where fail-open shows up

• Inline IPS and inspection devices: many appliances include hardware bypass, also called fail-to-wire, which joins the inbound and outbound ports when the device loses power or its engine hangs. An external bypass switch can do the same by sending heartbeat packets through the tool and routing around it when they stop.
• Overload settings: an IPS or next-generation firewall can be configured to pass traffic it lacks the capacity to inspect.
• Cloud lookups: URL filters, email scanners and endpoint agents that cannot reach their cloud service may default to allowing.
• Physical locks: fail-safe locks on exit paths release on power loss so people can get out. In physical security, fail-safe is the open choice, though in software design the principle of fail-safe defaults means the opposite: deny unless access is explicitly granted.
• Code: an authorization check that grants access when it hits an error.

Example: a fail-open bug in code

A document service checks permissions with two lines of Python:

• try: allowed = acl.check(user, doc_id)
• except TimeoutError: allowed = True # don't block users when the ACL service is slow

The comment shows the good intention, and the result is that anyone can open any document whenever the permission service is slow, a condition an attacker can create by flooding it. The secure version sets allowed = False in the error path and tells the user to try again. Access decisions should never fail open.

Example: a filter outage

A company's cloud web filter agent is set to fail open. During a two-hour provider outage, laptops keep browsing with no category blocking or download scanning, and nobody notices because users see no errors. That is the cost of the choice: work continued, and protection silently stopped. Attackers know the pattern and sometimes overload inspection devices into bypass before sending the real attack.

Making fail-open safe enough

• Alert loudly when bypass engages; a device that fails open silently looks healthy while inspecting nothing.
• Keep other layers working, such as the perimeter firewall, endpoint protection and logging, so one failed control does not leave the path open.
• Use redundant pairs where possible, so a failure moves traffic to a second inspecting device instead of into bypass.
• Document the chosen failure mode and test it by cutting power during a maintenance window.

Fail-open vs. fail-closed

Fail-open on the CompTIA Security+ exam

Failure modes are part of securing infrastructure under SY0-801 objective 3.2, and failing open in error handling is part of the unsafe exception handling weakness named in objective 2.4. Choose fail-open when the scenario says a system must stay available, operations cannot be interrupted, or human safety depends on access, such as patient care or people leaving a building in a fire. Choose fail-closed when it says no unauthorized access may occur even during a failure. Watch the vocabulary trap: for doors, fail-safe means unlocked. A passive IDS on a tap is a different answer, since it sits outside the traffic path and its failure costs only visibility, never traffic.