An administrator security policy defines allowed URLs, file types and parameter values. Which security model is the administrator using?

The negative security model uses a blacklist approach, blocking only explicitly known bad traffic patterns, which is the opposite of defining allowed values.

'Closed security model' is not a standard recognized security policy model in the context of web application firewalls or traffic filtering.

The positive security model operates on a default-deny principle by defining an explicit allowlist of acceptable inputs, including permitted URLs, file types, content-types, and parameter values. Any request that does not match the defined allowed criteria is blocked, making it the correct model described in the question.

An ACL security model filters traffic based on source/destination IP or port rules and does not define allowed URL patterns, file types, or parameter values.