Are temporary blocks sufficient response to network probes?

Question

We have the option of using an automatic blocking feature of our firewall to temporarily block the source IPs of network probes. It is fast and automatic, and it expires after a set amount of time.

However, our current practice is to manually put a permanent block in place for the source host (or net block for countries where we don't do business). I feel this is unmanageable and ineffective.

Here is my reasoning:

1. These are not sophisticated attackers targeting us specifically, most of these are probably random scans looking for low hanging fruit. A sophisticated attacker won't get caught by the firewall's probe detection, and will have other IPs in other netblocks available. Blocking the source of obvious probes will only deter the casually curious and the petty criminals.

2. By the time we manually respond to this event, the reconnaissance is usually over. We would be better off blocking the probe as it occurs, before they have time to get a complete picture.

3. Many of these are going to be dynamic IPs, which could later be reassigned to legitimate users who need to access our services.

4. Over time, it will become increasingly unmanageable (the list is already quite large), and will pose more potential for disrupting legitimate communication.

To date, we have acted in the belief that a permanent block is necessary to protect the network. We could always combine the two approaches, and add a permanent block after the automatic block activates, but I am wondering if the permanent blocks accomplish anything other than creating a false sense of security.

What is considered the best practice for this situation, or does anyone care to offer recommendations?

Answer 1

Security, in all senses is a layered approach. Each defense you have is one more against the plethora of attacks that can be thrown at your network. Automatically or permanantly banning IP addresses that are actively scanning you is fine, it provides a mild level of security in that those IP's will then be unable to attempt more advanced scanning techniques against your machines without changing IP's. With any luck, they'll believe you're offline altogether and just move on to the next target. Usually a block of a few days is more than enough.

Its important that you ensure your firewall is configured correctly and does not respond when it does not need to.

A sophisticated attacker won't get caught by the firewall's probe detection, and will have other IPs in other netblocks available.

There are other solutions available like Intrusion Detection Systems (IDS's) that may be able to combat more sophisticated attackers if they are a worry.

We would be better off blocking the probe as it occurs, before they have time to get a complete picture.

as a general rule, You should be dropping all traffic that does not match your inbound rules anyway. If the firewall then notices traffic that is attempting to scan your network, then add them to the blacklist (permanently or otherwise)

Many of these are going to be dynamic IPs, which could later be reassigned to legitimate users who need to access our services. Over time, it will become increasingly unmanageable (the list is already quite large), and will pose more potential for disrupting legitimate communication. This is why it is reasonable to have the temporary blocks (for 'x' number of days) in place.

Best practices are to keep blocking (even if temporarily) any suspicious/hostile IP addresses. This obviously cannont be the only security you have in place so checking that your firewall rules are up-to-date and correct as well as investing in an IPS should be something worth thinking about.

Hope that helps.

Answer 2

I believe the best approach is combining the automatic + permanent block for the most aggressive ones, after a period of time (1 month for example) you check if the rules blocking certain aggressive origin are still receiving any hits, if they don't you should simply clean them up, thus keeping your environment manageable.