Skip to content
OAShield

Positive Security Models

A positive security model defines and permits only known, trusted behavior while blocking everything else. It’s the opposite of a negative security model, which blocks known threats and allows all other activity by default. By focusing on what’s explicitly allowed, positive security shrinks the potential attack surface considerably.

Benefits of positive security models

  • Fewer false negatives. Only predefined legitimate activity is allowed, so malicious actions that don’t match a known threat pattern still get blocked. They just aren’t on the allowlist.
  • Protection against zero-day attacks. Since only specified behavior is permitted, exploits for unknown vulnerabilities are far less likely to succeed. An attack doesn’t need to be recognized to be stopped.
  • Strict input validation. Only correctly formatted, expected data is processed, which blunts injection attacks and other input-based threats before they reach application code.

The contradiction in common practice

Developers are (rightly) told to practice positive input validation and accept only known good inputs. Yet most perimeter security tooling does the reverse: it hunts for anomalies and known-bad patterns. That inconsistency leaves gaps in security coverage. Adopting perimeter tools that align with the positive model closes the gap between what secure coding guidance says and what the infrastructure actually enforces.

OAShield’s role

OAShield applies the positive security model at the WAF layer by generating ModSecurity and Coraza rules from your OpenAPI specification. Only valid API calls, as defined in the spec, are permitted. If an endpoint doesn’t declare a POST method, every POST to it is blocked; if a parameter isn’t declared, requests carrying it are rejected.

The trade-off of any allowlist is maintenance: the allowed list must stay current or it starts blocking legitimate traffic. OAShield addresses this by generating the allowlist from the API contract you already maintain, so keeping the WAF current is a build step rather than a manual chore. See How It Works for the mechanics.