I know my way around firewalls, but I am in no way a security expert. And recently, I am wondering how to effectively configure the outbound rules of any company's firewall.
For the question's sake, let's assume there is a state-of-the-art antivirus software installed on every client computer and web access is proxied and scanned for virus activity. Let's assume they are perfectly configurated, but an unknown virus, or specifically designed application (that does not require root rights) is executed on the computer in user space.
In theory, I would track all software that is used and configure the firewall to let through destination ports HTTP(S)/80+443, "Message Submission"/587 and IMAPS/993, as well as any destination port, that is necessary for LOB applications.
But that could easily be 10 to 20 destination ports, or more. They would have to be documented and updated, which would cause a great amount of work and is prone to errors, when any malware could just encapsule any information in a HTTP packet and send it to port 80 of the receiving end.
And that were, what I would do: If I were to write a virus to leak company information, or to join them to a botnet, I would not even bother connecting with the receiving/controlling server through port 6667/IRC, as it's usually blocked. I would simply encapsule all information in a HTTP packet and connect to destination port 80/HTTP.
I read about Deep Packet Inspection, but it seems to me, that I would have to know exactly how the destructive packet has to look like. In other words, I would have to create a DPI filter, that is able to differentiate between a file that is legally transferred via HTTP from a user, and a file that is illegally transferred via HTTP from malware.
With this thought, I don't see why I should do any more work on any firewall than allow any service from LAN to WAN.