If you're talking host firewall, I would focus more on making sure only the necessary services are installed and configured for startup - meaning only authorize

If you're talking host firewall, I would focus more on making sure only the necessary services are installed and configured for startup - meaning only authorized apps are listening inbound. For outbound, I don't have an answer, though I suspect there is one. For network, again, your required services should be somewhat easily definable for inbound unless you're hosting multimedia/UDP/P2P services. This is the basics... for enterprise level stuff you get into application-aware firewalls, IPS, and WAF.