V Interesting article on usefulness of outbound filtering

http://technet.microsoft.com/en-us/magazine/2008.06.security.aspx


Outbound Filtering section is near end of article.

Author has pretty impressive qualifications too.

 

The outbound filtering for the services is good, just a case to remember to bind the service to the rule.
I am just about to see how well it filters the returned packets.


- Stem

 

The section about outbound filter from that article starts with the assumption that all malware will try to use sofisticated measures to connect with an outside server. This is not true in most cases, so even a simple outbound firewall with app control will successfully stop most malware.

 

Really ? I thought most outbound malware was quite smart ?
I'm only starting on this part of security so ,that was just the impression I had.
The last MBR rootkit is probably on my mind too though.