Top countries where cyber attacks originate

[AdamCoombs]

Good day everyone, 

I am looking for some help information with finding "Top 15 countries where cyber attacks originate"

I know there are alot of blocklist out there, those have IP addresses. That is not what I am needing. 

If anyone can recommend websites or which countries they have blocked with the reason as well. 

I am looking to but together a report showing which countries would be best in blocking that active.

Thank you for any help you can provide.

[reaper]

hi @AdamCoombs

You may want to look into our Autofocus subscription

If you reach out to a sales team near you they can probably set you up with a trial (check out this link for a quick overview: Our Most Intelligent Service Yet)

[BPry]

@AdamCoombs,

I have to say that in general I really hate the idea of blocking countries simply because they are the source of a lot of attacks, that way of thinking is kind of outdated. You should only be allowing traffic that would actually be seen as legitimate. For example if I was a US based grocery store of some type I could setup my security policies to only allow traffic from certain countries without risk of blocking legitmate traffic. I might expect traffic from the US, Mexico, and Canada and block everything else because I don't have a need to allow the traffic anyways. 

Saying that you're going to block traffic from 'RU' or 'CN' is really simple because they do generate a lot of scanning, spam, and stuff like that. But why only block those two countries if you don't have a valid reason of allowing traffic from 'VN' or 'GB'? Geographically limiting access to your network is really easy with PAN; but the bigger question would be "What countries even have a valid reason to accesss my network" in the first place. If you can get away with limiting the source to just the US, or just the US, Mexico, and Canada why wouldn't you? 

[AdamCoombs]

Hey BPry, I understand what you are saying really I do. 

This is task, I have been asked to do .   

Lot of people can bypass this really easy, by using a proxy or vpn connection etc..... 

Is there a good article or articles you can share show this idea is not a good one. 

Anything you can provide would be great. As you have help me in the past.

[BPry · Accepted solution]

@AdamCoombs,

The entire concept is what many coin 'Zero Trust Architecture'. Palo themselves has a lot of good information on it HERE and HERE and why 'Zero Trust' is the better way to do things. 

It's not necessary that blocking source countries that are known bad actors is a bad thing, it will certaintly help cut down on the number of logs and such being detected; it's that this is the lowest hanging fruit, it may have already even fallen off the tree. In my mind it's better to get into their mind of only handling legitimate traffic.

[DonohoeRobert]

Hi Mate, 

Would aggree with all of the above. Can differ from network to network, what locations to block.Running a custom report off a deny rule, currently blocking threats or inbound traffic could help you make your mind up in respect of the risk of traffic to or from certain countries aswell.

Best regards,

Rob

[WillAlt]

Hello,

There are multitude of articles and what not out there. You might wanna turn on Google Alerts for something like that. I dont know if I am allowed to give links but you can type top 10 countries, or most hacked countries.