Practical Network Scanning

What is blacklisting?

Most of the antivirus suites on the market work with a blacklist approach to detecting and preventing viruses and malware. In the 1980s, antivirus was first introduced with blacklist. Today, the antivirus industry still follows the same principle. This works similar to creating a list of all cyber criminals in the world. However, what happens if you miss a few criminals, or if they are new and are not on the list? Depending on the IT environment, blacklisted entities might extend to users, applications, processes, IP addresses, and organizations known to carry threats to an individual or other organization.

Blacklisting delivers almost no value against zero-day threats.