Our company wants to block data exfiltration. They want to control outbound traffic going out from unused ports. I did traffic flow analysis at our edge firewalls to know which ports are used by our applications. There are some 2000 ports through which traffic is going out(to outside network or Internet) which means some 65535 - 2000 -1024(reserved ports) 62511 ports are unused so can be blocked or we can set Access Control List(ACL)s to allow only the 2000+1024 ports = 3024 ports and block the remaining. I know using 62511 ACL rules to block the unused ports is lot longer than writing 3024 ACL rules to whitelist the used ports.
I understand a nation state attacker can use tunneling to exfiltrate data using commonly used ports such as 443, but we are trying to limit data exfiltration. We use Cisco gear and ASA firewalls.
I know using range command in ACL, I can group the contiguous ports something like
object-group service CLOSE-PORTS tcp port-object range 2000 3000 port-object eq 80 port-object eq 443
access-list TEST extended permit tcp host internal_host host outside_network_host object-group CLOSE-PORTS
where internal_host and outside_network_host can be IP addresses with subnet masks like 10.0.0.1/24
Is blacklisting ports(blocking unused ports) better or whitelisting(only allowing outbound traffic from ports) better?
How can I ensure the ACL is not too long which can impact router/firewall performance? Is there a way to reduce ACL length?
Any other suggestions on how to do this to prevent data exfiltration would be helpful.