Lunchbox InfoSec

While reading this article this caught my eye.

"There are more malware command and control (C&C) servers in the US than China, only scant malware in porn and few instances of multiple malware infections on single computers, according to research."

So if you think that geo-blocking foreign countries will solve your issues, best of luck to you.

If your organization is looking for real time reputation service then I suggest looking into something like TippingPoint's RepDV (http://h17007.www1.hp.com/tw/en/solutions/security/reputation-digital-vaccine/).

If your organization doesn't have the funds for this then implementing blacklist IP addresses on your border router or your firewall is always a good alternative. Just remember these recommendations.

Risk rating is the core of Cisco IPS alerting. This is a great overview of how risk rating is calculated. Using the Cisco IPS Manager Express with the knowledge of risk rating  you'll be able to limit down attacks that need to be reviewed.