> ## Content Index
> Fetch the complete content index at: https://www.ostering.com/llms.txt
> Use this file to discover other available public pages before exploring further.
# Firewall and Quarantine (FW)
- URL: /taxonomies/software-factory/firewall-and-quarantine/
- Published: 2026-10-31T13:00:00.000Z
- Updated: 2026-10-29T12:59:48.133Z
- Description: Firewall and Quarantine (FW): 13 threats, software factory taxonomy. Dependency firewalls, curated proxies, cooldowns, quarantine, allow lists and exceptions.
- Author: Brett Crawley
[Taxonomies](/taxonomies/) › [Software factory](/taxonomies/software-factory/) › Firewall and Quarantine
**Station 11 of 17 · Line 2, Artifact to Runtime · 13 threats · prefix FW**
A dependency firewall works only if it is the single way in and judges what it serves, not what it once saw. These cards cover dependency firewalls, curated proxies, cooldowns, quarantine and the exceptions that keep builds moving.
**Scope:** Dependency firewalls, curated proxies, cooldowns, quarantine, allow lists and exceptions.
*Text version: every entry on this page is in the [PDF and Excel downloads](/taxonomies/software-factory/) on the overview page, where it can be searched and copied.*
## The threats
- **FW·A** Bypass Route
- **FW·K** Pre-Policy Cache
- **FW·Q** Broad Exception
- **FW·J** Detection Window
- **FW·10** Fail-Open Firewall
- **FW·9** Ecosystem Coverage Gap
- **FW·8** Coordinates Without Content
- **FW·7** Quarantine Release Abuse
- **FW·6** Fetch Visibility Gap
- **FW·5** Heuristic Evasion
- **FW·4** Firewall as Target
- **FW·3** Friction Bypass
- **FW·2** Policy Drift
## Where this station touches others
- **Registries and Firewall and Quarantine:** the registry is where components live; the firewall decides which of them reach a build.
- **Dependency Resolution and Firewall and Quarantine:** resolution decides what is asked for; the firewall decides what is served.
- **Scanners and Gates and Firewall and Quarantine:** scanners judge what the factory makes; the firewall judges what comes in from outside. Both stations treat the control itself as a component that can fail or be attacked.
## Seen in the wild
- **FW·J Detection Window:** Shai-Hulud (2025).
Sources for each case are listed on the [overview page](/taxonomies/software-factory/).
## STRIDE, CAPEC and CWE
Of the 13 entries here, STRIDE fits 5 cleanly and 8 only loosely. CAPEC 3.9 has no pattern that describes any of them directly; it has a generic parent pattern for 10 and nothing for 3. CWE 4.20 names the weakness directly for 6, has only a broader weakness for 7,. The table below gives the mapping entry by entry, with the names of the CAPEC patterns and CWE weaknesses; what the mapping shows across the whole taxonomy is in [Mapping the Software Factory Threat Taxonomy to STRIDE, CAPEC and CWE](/mapping-the-software-factory-threat-taxonomy/). The Excel, SKOS and STIX downloads carry the same mapping as text.
---
← [Registries (RG)](/taxonomies/software-factory/registries/) · [Software factory overview](/taxonomies/software-factory/) · [SBOM and VEX (BM)](/taxonomies/software-factory/sbom-and-vex/) →
*© 2026 Jonathan Brett Crawley. Licensed under [CC BY-NC-ND 4.0](https://creativecommons.org/licenses/by-nc-nd/4.0/) with additional permissions: see the licence on the [software factory overview](/taxonomies/software-factory/).*