The answer is simple, block anything that appears suspicous, regardless of where it comes from. It is not my fault that your computer has some form of spyware/worm/other nasty, IT IS MY JOB to make sure you don't compromise my system.

I have traced suspicous requests including port scans back to Russia, no problem, block them, a mammoth task indeed - how about this for an idea... have firewalls block requests by region, web server scripts allow customised content based upon your region, how about no content at all.

My final comment, there has been a recent increase in the amount of websites checking whether or not you are in their region, if you are not they tell you the site you are looking at is not valid and does not apply to you, and that you should visit their "international" site, if this is happening, then surely using firewalls to block by region is a logical next step.

For the record, I disagree with this notion as a user, but as an IT Manager I would implement it in a heartbeat.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/350/32295#32295