Discussion: Where’s the Best Place For Country Blocks?

In a scenario where your SMB or enterprise gets constantly bombarded (portscans, brute force, spam, etc.) by Russia, China, Brazil, et al., and where you don’t do business in these countries, where’s the best place to block them?

Here are a few options (add as necessary):

• Border router ACL

• Firewall ACL

• Separate, dedicated appliance

• Network IPS

• Border router routing (blackholing)

This is also assuming you can’t do a simple, tight whitelist ACL on the firewall–which would make the solution pretty easy–and instead have to specifically blacklist because there are a large number of legitimate foreign IP blocks.

Related: Do you guys blacklist at a granular level (hundreds or thousands of networks), or do you do only the few primary /8’s?

What are your thoughts on the best method?

Related posts:

1. Explaining Threats, Threat Actors, Vulnerabilities, and Risk Using a Real-World Scenario

2. Day-1 Skills That Cybersecurity Hiring Managers Are Looking For

3. A Remarkably Clear Overview of The Border Security Situation

4. Everyday Threat Modeling