1

Some vendors like Palo Alto Networks make appliances that will sync blacklists across all of their client base when one of their clients gets attacked. So after the first guy gets attacked, all of the others in the same "good guy" alliance are protected.

My question is: How would Palo Alto know who to trust? What if one of their clients, or anyone who could find a way to talk to their web service tries to blacklist Google? How do you establish the kind of trust in the clients needed for a shared global blacklist?

1

Usually it's a mix of black and white listing to avoid that specific problem. Occasionally mistakes are made but they are usually resolved very quickly.

I can't speak for any particular vendor but there are a lot of good free threat intelligence feeds that many organizations contribute to to minimize accidental blocking of valid addresses.The way any specific vendor handles the trust rating and what to publish is likely different from vendor to vendor but generally they've all been working through those issues for a few years and gotten good at it.

Another aspect is the trust rating of any given IP is the network it's from. Large ranges of IP's can be attributed to specific owners via their BGP AS numbers. This helps incident responders contact the owner of an IP and it also helps people know if this is an IP run by a risky small ISP known for hosting lots of malware vs. a very reputable organization like a hospital that may have an infected host.

Likewise there are lots of lists for known Good hosts (top Alexa websites) and known Bad/Malicious hosts (Russian Business Network type hosts).

You may want to look into these lists as well

https://zeltser.com/malicious-ip-blocklists/

It's a lot of work to create these feeds but they are very valuable tools to block/slow-down attackers.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.