Companies that offer public services outside of their internal network may adopt on philosophy for those machines, while adopting the other for important resources. That which is not explicitly allowed, is denied. Simply put, if you do not go out of your way to explicitly and intentionally allow a particular user or service, then the traffic to your network is denied. For the most part, this is the philosophy that all networks should take. Another way of looking at this is to close all resources from the start, and slowly open them as needed to continue network functionality.
Incoming traffic is checked against each rule one at a time.
If it doesn't match the first three, it then matches the final rule denying the traffic. This security philosophy defaults to the most secure posture for your network, and is ideal for corporate networks with an Internet presence. That which is not explicitly denied, is allowed. Opposite of the other philosophy, this one is intended for open networks that share resources with almost anyone. This philosophy is best suited for public resources found at colleges, search engines, etc.