Filtering IP Addresses due to Hacking

First, I'd like to say that I hope someone from a larger network answers this, my networks are much smaller than the ones you operate. Please excuse me if this is totally irrelevent to you ;>
I was recently asked to block an entire country and was able to discourage this. The time-consuming point is valid, but the one I used and believe to be true, is that it is nearly totally ineffective. If you are a target (i.e. big business, "hacktivist" target, mad ex-employees, considered lucrative to organized crime etc., then blocking ip's is entirely useless. People that are good and motivated will forward and spoof ip's at will.
1. I temporarily block any ip's engaging in Denial of Service against my networks. I recognize these ip's may not realize they are doing this and un-block in about a month. I don't block on a probe, and explain to clientle that ask that these do not necessarily represent attacks.
2. Block on external routers A.S.A.P if DoS'd
3. DoS or malicious intrusion.
4. No
5. 1 to 3 months. There are so many more accessible interesting systems out there I don't see people waiting around -unless you are specifically being targeted due to the nature of your business.
6. It is too many when the cost (monetary and other) outweighs the benefit.

I see a lot of knee-jerk reaction to media hype and a scared general public out there. Sometimes (like y2k) this leads to the business spending way to much on the wrong inneffectual plans. Unfortunately, sometimes peoplewould rather listen and respond to hype than the voice of reason. Good Luck!, and I'll be interested in seeing additional responses -good question! :)

It might be easier to start on a different qustion because some of the answers overlap, but taking them in the order you asked...

1. Do you filter or block inbound IP traffic based on past probes or hacking attempts?

I block on known hacker activity (i.e. SMB ports 137/138/139), accept SMTP only from known Relays (our ISP), same with DNS (no inbound DNS allowed). I limit inbound protocols to HTTP, Telnet, FTP, etc, and only accept connections to our Firewall from known hosts. If your Firewall isn't "smart" enough to prevent spoof'ing, you will have to rethink a whole Corporate Security strategy.

2. If so, do you apply filters on your external border routers to reduce chances of a Denial of Service attack, or on your firewall due to its improved logging and reporting capabilities?

Both. For the most part [in regards to your question], most of the anti-hacking actions we take are done on the Firewall (more efficient), and that way local LAN traffic isn't impacted as much (only traffic to/from the Firewall). We allow certain protocols to only run on outbound service requests. Clients can FTP to anywhere from inside the Firewall (Private Interface), but inbound (Public) will be rejected unless a rule is specifically generated to allow access. What we do run on the routers is TCP/53 filters which prevents someone (vendor/quest) from getting a DHCP address then doing an NSLookup command and doing a "Zone Transfer" dumping SVR's and Servers to a file. Other than that we don't do a whole lot of filtering on Border routers [if a Firewall is available] because of the overhead (a Firewall is which more efficient).

3. What criteria do you use to determine if a filter should be implemented for an IP address, subnet or net block?

We really concentrate on TCP/UDP ports more than IP Addresses, less security issues (spoofing/Port Forwarding to different IP Address), plus you get into situations
trying to figure out which rule has a higher "weight"... and that gets time consuming and tricky to keep adding those types of rules. I'd suggest if in doubt deny all, then open up only ports [with attached rules: Inbound from IP to IP only] where there is a business justification to offset the risk.

4. Do you block entire net blocks solely based on their geographic region? ie. China, North Korea, or IANA Reserved

"Yes"

5. How long should an address be blocked: 3 months, 6 months, a year,
2 years, forever? Do you go back and review blocked addresses?

Forever, or until a business request is made to change security (reguires a business justification-not Client A want access to a WareZ site in Russia). We do add rules to access China sites, but setup the Firewall if accessing (via HTTP) a server in China to prompt for Username/Password on Firewall to verify client accessing the link is authorized (we could hot-wire the access to his IP Address if he didn't travel with a Lap Top).

6. How many blocked addresses is too many? At what point does it become too burdonsome?

I couldn't even tell you, it varies greatly by the risks management is willing to accept and the type of hardware (Routers/Firewalls) you have available to you. You even get into area's where if you do allow certain types of protocols to run (Streaming Audio over HTTP for example), it impacts someones ability (speed) to download [FTP] files from a vendor. So there are lots of trade-offs, everyone just has to define the Pros/Cons.

Hope that Helps,
Matt