Implement and monitor egress filtering — outbound traffic controls detect exfiltration

Most network security focuses on blocking inbound connections. Egress filtering — controlling and monitoring outbound connections — is equally important and frequently neglected. The Codecov bash uploader attack sent CI/CD secrets to an attacker-controlled server via HTTP. The CCleaner backdoor sent system data outbound via standard ports. Without egress filtering, any process on any machine can establish outbound connections to any address. Implement explicit allow-listing for outbound traffic from sensitive systems, log all egress connections, and alert on connections to newly registered domains or unexpected geographic regions.