Security requires default-deny egress across the estate. Engineering says it will cause constant outages. How do you deliver it?

Why security is right

Inbound is default-deny nearly everywhere. Outbound is usually wide open, on the reasoning that traffic originating inside is trusted.

That assumption is what exfiltration, command-and-control and SSRF depend on. An attacker with code execution needs an outbound path to be useful. Egress control is one of the highest-value remaining controls in most estates.

Why engineering is right

Guessing at an allow-list produces outages. Services reach package registries, certificate authorities for OCSP, telemetry endpoints, cloud APIs, licence servers and third-party APIs — most of it undocumented and much of it behind CDN addresses that change.

The method that satisfies both: observe, then enforce

Phase 1 — observe. Enable flow logs everywhere. Do not enforce. Build the allow-list from recorded traffic over a period long enough to capture monthly and quarterly jobs. This is the step that turns guessing into evidence, and it is why the whole programme succeeds or fails here.

Phase 2 — log-only enforcement. Apply the policy in a mode that records what would have been blocked. Every entry is a conversation with a team, not an incident.

Phase 3 — enforce, environment by environment. Development first, production last, with a fast documented exception path. A slow exception path guarantees the policy is bypassed or reverted.

Design choices that make it maintainable

Reference security groups rather than CIDR ranges, so rules survive autoscaling and address changes.

Private endpoints for cloud services, which removes most egress requirements entirely — cheaper, more secure and fewer rules.

An egress proxy with domain allow-listing for the traffic that must reach the internet, because addresses change and domains are what teams can actually reason about. It also gives you a single place for logging and inspection.

What a strong answer adds

Naming the stateless trap that produces most "the rule allows it but it still fails" tickets: network ACLs are stateless, so return traffic needs its own rule including the ephemeral port range. Security groups are stateful and should be the primary control; NACLs a coarse secondary one.