...firewalls often provide a mere illusion of protection. They don’t make business systems significantly more secure. And by focusing attention on defending the perimeter, rather than on defending information assets within an organization, firewalls foster lax internal security practices that magnify the damage that insiders can inflict.
What firewalls do accomplish, however, is this: they make the Internet more cumbersome to use. I recently visited a friend’s firm in New York and wanted to check my e-mail, so I plugged my laptop into a network jack in an unused office. Access denied: my PC wasn’t set up to work with the company’s firewall. So instead of reading my e-mail, I occupied myself by sniffing the traffic on the office network and probing for a way out. (Had I been inclined, I could have read everybody else’s e-mail—or done real damage.)