Our organization has blocked all access from China. Why? because we've been bomabarded continuously by hack attempts, viruses, port-scanning, and everything else you can think of -- all from China. We aren't going to block every single country that we don't do business with -- just the ones that become problematic. China has become problematic. Our hands are sort of tied here: what are we supposed to do? Let our servers get overrun by hack attempts just because we think that someone somewhere in China MIGHT want to view our website? It wouldn't do them any good anyway, since we don't have any kind of prescence in China, and we can't service any clients in China.

The problem started when we found several explicit hack attempts on our email server and on our domain controller. They all came from the same IP, and they wer recurring night after night. So we blocked the IP.

The very next night, we had an identical attack from a different IP. We blocked that one. Same results. When I suggested that we block China altogether, I knew it was an extreme measure, and even voiced the concern that it was an extreme measure. The senior administrator agreed that it was extreme, but we went ahead and did it. Since then, we have had little or no trouble with attacks or any other security concerns, other than the standard virus/spyware problems.

From what I know of the situation in China, the authorities spent a long time either not caring or not knowing about the cyber-problems in their country, but recently I read an article in which a Chinese hacker got prison time, so maybe they're trying to take care of it. Until then, however, we HAVE to do something to protect our servers.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/350/32311#32311