The first thing you need to do is categorize the hosts/networks inside your company:

1. Desktop hosts (used by employees for web surfing)
2. Datacenter hosts (used by specific applications for specific purposes)
3. Compliance hosts (PCI, HIPPA, FERPA)

Datacenter and compliance hosts are the easiest to apply egress rules. Because these hosts are used by specific applications, you can (eventually, after log and traffic analysis) block egress access to the Internet, except for specific sockets needed for specific applications. My "standard datacenter ACLs" for new datacenter subnets included a deny-by-default egress rule permitting access to other datacenter nets, but denying egress access to desktop and internet networks.

For desktop networks, it is infeasible to apply egress rules. As soon as you allow people to websurf, you can't stop it. But there are two things you can do:

1. Use netflow data to detect large egress data flows. Some vendors sell products to look for data exfiltration from netflow and network tap data.
2. Prevent desktop networks from accessing datacenter networks without authentication (I like having a separate "datacenter VPN" for IT personnel only, desktop networks are considered outside the datacenter security perimeter)

Compliance hosts have special requirements. I'll assume PCI for the rest of this discussion, since that's what I'm familiar with.

PCI hosts are not allowed unrestricted egress access to the internet. One test most PCI auditors do is attempt to ping the internet from hosts that are in-scope. If they can ping the internet (or websurf the internet) that requires remediation.

Specific egress sockets to specific destinations are ok for business reasons (you've got to be able to reach your credit card processor).

That gives you 3 levels of security, in increasing order:

1. Desktop hosts
2. Datacenter hosts
3. Compliance hosts (hopefully in restricted part of datacenter, but public helpdesk personnel taking customer credit card numbers are a difficult case).

Prevent #2 and #3 from egress access to the internet, and restrict access between the security levels.

Naturally, ingress access from the internet should already be blocked to all 3, except public-facing internet services. Stateful firewalls are explicitly required for PCI compliance zones.

The first thing you need to do is categorize the hosts/networks inside your company:

1. Desktop hosts (used by employees for web surfing)
2. Datacenter hosts (used by specific applications for specific purposes)
3. Compliance hosts (PCI, HIPPA, FERPA)

Datacenter and compliance hosts are the easiest to apply egress rules. Because these hosts are used by specific applications, you can (eventually, after log and traffic analysis) block egress access to the Internet, except for specific sockets needed for specific applications. My "standard datacenter ACLs" for new datacenter subnets included a deny-by-default egress rule permitting access to other datacenter nets, but denying egress access to desktop and internet networks.

(my standard datacenter ACL also had datacenter->datacenter ingress rules, not discussed here).

For desktop networks, it is infeasible to apply egress rules. As soon as you allow people to websurf, you can't stop it. But there are two things you can do:

1. Use netflow data to detect large egress data flows. Some vendors sell products to look for data exfiltration from netflow and network tap data.
2. Prevent desktop networks from accessing datacenter networks without authentication (I like having a separate "datacenter VPN" for IT personnel only, desktop networks are considered outside the datacenter security perimeter)

Compliance hosts have special requirements. I'll assume PCI for the rest of this discussion, since that's what I'm familiar with.

PCI hosts are not allowed unrestricted egress access to the internet. One test most PCI auditors do is attempt to ping the internet from hosts that are in-scope. If they can ping the internet (or websurf the internet) that requires remediation.

Specific egress sockets to specific destinations are ok for business reasons (you've got to be able to reach your credit card processor).

That gives you 3 levels of security, in increasing order:

1. Desktop hosts
2. Datacenter hosts
3. Compliance hosts (hopefully in restricted part of datacenter, but public helpdesk personnel taking customer credit card numbers are a difficult case).

Prevent #2 and #3 from egress access to the internet, and restrict access between the security levels.

Naturally, ingress access from the internet should already be blocked to all 3, except public-facing internet services. Stateful firewalls are explicitly required for PCI compliance zones.