BCN-T3-NET-003Tier 3 · Best PracticesNetwork

Incomplete Egress Filtering

Unrestricted outbound connectivity, permitting unconstrained command-and-control and exfiltration.

Remediation SLA: 90 days
Tier: 3 · Best Practices
Domain: Network
Escalation: Reviewed at quarterly planning; may be formally deferred

What this finding is

Workloads can initiate outbound connections to arbitrary internet destinations on arbitrary ports. Most environments filter inbound rigorously and outbound not at all, leaving a compromised workload free to reach any command-and-control endpoint and to exfiltrate at will.

Why it is Tier 3

Egress filtering does not prevent compromise; it constrains what an attacker can do afterwards, breaking the command-and-control step that most intrusion tooling depends on. It is Tier 3 because implementing it in a mature estate requires substantial discovery of legitimate destinations and carries real breakage risk — it is a project rather than a change. The defensive value is nonetheless high.

Most common misclassification

Abandoned as impractical rather than being recorded and deferred. Beacon treats formal deferral with a recorded rationale as a legitimate Tier 3 outcome — an undocumented decision not to do it is not.

How to detect it

1Review egress rules for unrestricted destinations, particularly on workloads processing sensitive data.
2Analyse flow logs to establish which outbound destinations are genuinely used — this is the necessary input to any allowlist.
3Check whether DNS resolution is unrestricted, since DNS is a common exfiltration channel that port-based filtering does not address.
4Identify workloads with no legitimate outbound need at all — these are the correct starting point.

How to remediate it

Steps are ordered. The first step is the one that reduces exposure fastest, which is not always the one that closes the finding.

1Begin with workloads that have no outbound requirement, where default-deny is achievable immediately and without risk.
2Build allowlists from observed flow data rather than from documentation, then apply in monitor-only mode before enforcing.
3Route necessary egress through inspecting proxies for logging and policy enforcement.
4Restrict DNS to approved resolvers and monitor for tunnelling patterns.
5Use provider private endpoints so that provider-service traffic does not require broad internet egress.

How to verify the fix

Sensitive workloads deny outbound connections to destinations outside the allowlist, the denial is visible in flow logs, and DNS resolution is confined to approved resolvers.