Organizations across the world are revisiting geography-based cybersecurity and travel restrictions in light of the Russian invasion of Ukraine.

During this talk, we will explore the tools, settings, and policies available to companies to limit internet and physical access from or to specific countries and regions. We will discuss how companies and critical infrastructure apply those controls and considerations before and during a time of crisis. Finally, we will discuss valid and invalid reasons why an organization might consider implementing such restrictions.

Specific topics covered will include the science behind IP address to location mapping and benefits or limitations to using that data in enforcement, possible false-positive implications of such restrictions, and common mistakes made when attempting to implement such controls. Common approaches to classifying countries and regions by risk and sanction status will also be discussed.