{
  "id": 15259956,
  "title": "Egress Filtering: The Control That Makes Exfiltration Expensive",
  "url": "https://urgent.news/2026/10/17/egress-filtering-the-control-that-makes-exfiltration-expensive",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-17T19:00:57.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/kozhevniko/egress-filtering-the-control-that-makes-exfiltration-expensive-3aei"
  },
  "original_language": "en",
  "account": "Outbound traffic is often overlooked, and egress filtering is a crucial measure against data exfiltration. Despite preventing exfiltration, it does increase complexity and cost. A permissive egress rule permits any destination on any port. The spectrum of alternatives proposes denying direct outbound access by IP address and implementing a named destination. Another approach involves restricting by a catalogue of allowed destinations, such as the registry, package repository, identity provider, and update endpoint. Restricting by protocol is also recommended, as services only needing HTTPS do not require unrestricted DNS, and a build system pulling from a mirror does not need arbitrary SSH. Logging denials is essential, as blocked outbound connections are reliable indicators of unusual behavior. However, mistakes can occur during initial deployment, such as deriving the policy from documentation instead of observed traffic. A proxy becomes a single point of failure and inspection, necessitating thorough patching, monitoring, and sizing. Denied traffic should be logged but not overlooked, as the review of such logs is where the control's value lies. Attackers adapt, so egress filtering changes their problem from choosing a path to abusing a permitted one, which is a significant difference but not a complete defense. Ultimately, egress filtering converts an open network into an observed one, making it less vulnerable to ordinary incidents rather than stopping determined adversaries.",
  "summary": "Egress Filtering: The Control That Makes Exfiltration Expensive The asymmetry worth correcting Inbound filtering receives most of the attention, and outbound traffic is left permissive because a strict egress policy breaks things on the day it is enabled. The asymmetry has a cost. Once an attacker has execution, an unrestricted outbound path lets them choose their own protocol, destination and…",
  "key_points": [
    "Egress filtering prevents data exfiltration but increases complexity and cost.",
    "Deny direct outbound access by IP address and implement named destination restrictions.",
    "Log denied outbound connections to detect unusual behavior and evaluate control effectiveness."
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}