Your organization subscribes to a commercial threat intelligence feed that provides malicious IP addresses. A new analyst proposes blocking all IPs from the feed at the perimeter firewall immediately. What risk does this approach carry?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — blocking every IP from a threat feed can knock out legitimate traffic because feeds include stale entries, shared hosting, and CDN ranges. You need confidence scores and validation before automated enforcement.
Full Explanation
The correct risk is false positives: threat intelligence feeds contain entries of varying quality; stale entries (command-and-control IPs now hosting legitimate content), shared hosting IPs, and CDN ranges can cause legitimate business traffic to be blocked — potentially causing outages. Confidence scoring and validation are essential before automated blocking. The claim that there is no risk is wrong because no threat feed guarantees 100% accuracy or currency. The concern about tipping off attackers is wrong because automated firewall blocking does not expose your detection capability to the attacker. The GDPR concern is wrong because blocking an IP address is a network security control, not a GDPR data processing activity.