I see my previous question was closed as duplicate of Why block outgoing network traffic with a firewall?. The answers that everyone agree with mention the value of blocking outgoing connections (to limit the call-home-and-get-additional-instructions ability of bad-ware), but not so much the effectiveness of using a port white-list that includes HTTP and HTTPS. This new question requests additional attention in that area..
Obviously incoming connections must be blocked. (except to a white-list of address+port combinations - for example in case you are running a webserver on your network)
Requirements: Assuming that it is mandatory to allow web browsing (keep HTTPS and HTTP and DNS as open)... Is this below analysis correct? (Remember, all of these below are except for the white-list of IP addresses, which is useful for blocking DNS and SMTP, but not acceptable for blocking HTTP and HTTPS)
- Restricting SMTP would have significant real value.
- Restricting DNS would have a little real value.
- Having some white list of ports and blocking all the others has some real value so the bot-writers who just 'make up' a port will have no success.
- Opening additional ports is not a security risk on a one at a time level. If you have already opened HTTP/HTTPS, then you are not going to gain a measurable advantage by limiting out things like NTP, FTP, WHOIS.
- Requiring a Proxy before using HTTP/HTTPS would be the only real way (given the above requirements) to have significant real value, particularly if you configured the Proxy on the browser level (the second or third place a bot would look for a proxy config), instead of the computer-wide level (the first place a bot will look for a proxy config). (you may need to add a white-list of addresses for your Windows automatic updates so that a proxy is not required for those)
Are there inaccuracies in this analysis? Should there be more to this analysis?