I understand that somebody would want to block incoming traffic as a general rule except for public resources. And I also understand that you could want to block all outgoing traffic except for certain external services.
But is there any serious security risk if I allow incoming traffic that represents responses to previous outgoing traffic, e.g. HTTP requests?
Potentially the security risk is enormous. As a simple and common example: A compromised or malicious web site could infect or otherwise compromise the machine that was browsing the site, which in turn could cause all manner of problems on the rest of the network.
Such risks can be reduced and controlled of course using such things as sensible user level permissions, which will normally prevent the problem from spreading beyond the affected machine.
Organisations or departments that are really serious about security, such as some military and other government departments, don't allow certain machines or even entire networks to access the Internet for just these reasons.
For the vast majority of systems, with good management, of both IT systems and the people who use them, the risks are in reality fairly minor but never zero.
It's a balancing act. On the one side you have a secure network with no Internet. On the other you have a network that runs some risks but is able to use the many advantages of Internet access.
It's not much different to driving, or being driven in, a car. There is a very real risk of death but how many of us refuse to get in a car for that reason?
