Egress Filtering: The Control That Makes Exfiltration Expensive

Outbound traffic is often overlooked, and egress filtering is a crucial measure against data exfiltration. Despite preventing exfiltration, it does increase complexity and cost. A permissive egress rule permits any destination on any port. The spectrum of alternatives proposes denying direct outbound access by IP address and implementing a named destination.

Another approach involves restricting by a catalogue of allowed destinations, such as the registry, package repository, identity provider, and update endpoint. Restricting by protocol is also recommended, as services only needing HTTPS do not require unrestricted DNS, and a build system pulling from a mirror does not need arbitrary SSH.

Logging denials is essential, as blocked outbound connections are reliable indicators of unusual behavior. However, mistakes can occur during initial deployment, such as deriving the policy from documentation instead of observed traffic. A proxy becomes a single point of failure and inspection, necessitating thorough patching, monitoring, and sizing.

Denied traffic should be logged but not overlooked, as the review of such logs is where the control's value lies. Attackers adapt, so egress filtering changes their problem from choosing a path to abusing a permitted one, which is a significant difference but not a complete defense. Ultimately, egress filtering converts an open network into an observed one, making it less vulnerable to ordinary incidents rather than stopping determined adversaries.