Firewalls are designed with the principle of least privilege, meaning they should deny all traffic by default and only allow traffic that is explicitly permitted through defined firewall rules. This approach ensures that any traffic not reviewed and accepted by the security policy is automatically rejected, minimizing the risk of unauthorized access.