Egress rules that would have caught Salt Typhoon

CISA advisory AA25-239A documented the China-linked Salt Typhoon campaign compromising around 600 organisations across 80 countries, living on edge routers, adding GRE tunnels for persistence and capturing TACACS+ authentication traffic. The lesson for an agency: outbound is a control surface, not an afterthought.

1. Why the edge device. It is the one box with no EDR, and it sees all the traffic.
2. What Salt Typhoon did with it. Persistence via GRE tunnels, credential capture, quiet exfiltration.
3. Egress as a first-class control. Default-deny outbound, allow-listed destinations, ISM-aligned rule policy.
4. On Azure Firewall. Rule collections, logging to the SIEM, and the managed operating model.
5. The commercial line. Fixed monthly management, Azure billed at cost, 0% markup.

Blends the security case (a campaign every government reader knows) with the commercial model that defines the product: fixed management fee, Azure at cost. It shows we manage the outcome, not resell Azure at a markup, which is a direct shot at the big-vendor opacity our persona is tired of.

• Anchor on Salt Typhoon by name; it is the recognisable event.
• Frame egress control as the mitigation, and map rules to the ISM.
• Use this to state the at-cost, 0% markup billing model plainly.
• Note the edge-device EDR blind spot ties back to the SIEM dives.