We have the option of using an automatic blocking feature of our firewall to temporarily block the source IPs of network probes. It is fast and automatic, and it expires after a set amount of time.
However, our current practice is to manually put a permanent block in place for the source host (or net block for countries where we don't do business). I feel this is unmanageable and ineffective.
Here is my reasoning:
These are not sophisticated attackers targeting us specifically, most of these are probably random scans looking for low hanging fruit. A sophisticated attacker won't get caught by the firewall's probe detection, and will have other IPs in other netblocks available. Blocking the source of obvious probes will only deter the casually curious and the petty criminals.
By the time we manually respond to this event, the reconnaissance is usually over. We would be better off blocking the probe as it occurs, before they have time to get a complete picture.
Many of these are going to be dynamic IPs, which could later be reassigned to legitimate users who need to access our services.
Over time, it will become increasingly unmanageable (the list is already quite large), and will pose more potential for disrupting legitimate communication.
To date, we have acted in the belief that a permanent block is necessary to protect the network. We could always combine the two approaches, and add a permanent block after the automatic block activates, but I am wondering if the permanent blocks accomplish anything other than creating a false sense of security.
What is considered the best practice for this situation, or does anyone care to offer recommendations?