Lion Cipher Lab
Derive an egress allowlist from observed flows and replay it
- Cyber / Security Engineer
- Intermediate
- ~40 min
- Free · no account required
Why it matters
Most networks let servers connect out to anywhere on the internet. That makes an attacker's life easy: malware calls home, stolen data leaves, and tools are downloaded, all over ordinary-looking HTTPS. Egress filtering, meaning a default-deny policy for outbound traffic with only approved destinations allowed, is one of the most effective controls against all of that. NIST's firewall guidance (SP 800-41) discusses filtering outbound traffic, and zero trust architecture (NIST SP 800-207) is built on granting access only where it is needed. The hard part is deciding what to allow. The usual…
What you'll learn
- why default-deny egress matters
- learning an allowlist from observed traffic
- replaying later traffic to measure breakage
- the poisoned-baseline problem
- the rare-but-legitimate destination problem
- choosing a learning threshold and reviewing the result
- maintaining an allowlist over time
Steps in this lab
- Default-deny egress, and how an allowlist is usually built
- Two weeks of flows
- Write the learn-and-replay script
- Replay at two thresholds
- Learn, then review: a method that works