Chapter 2. Getting Started

Starting off this chapter, we're going to repeat a topic covered in Chapter 1, a topic that in our opinion can't be repeated enough. A firewall is never going to be enough to secure your network, your hosts, your data, or whatever else you are trying to protect; you must do more. It takes a lot more than one method, a firewall, or even technology alone to manage risk. Technology alone will not suffice. If you find yourself repeating it until you are blue in the face, you will understand why this is such a critical point to repeat. Risk management is more than technology and more than policies or any other single element. It takes the full spectrum of risk management solutions to truly address the problem.

In case the point wasn't clear the first time we said it, a firewall alone will not make your computer security problems go away. With that said, the goal of this chapter is to explore and expand on those concepts that can help you to protect your computing assets where a firewall cannot. The most important element of that total approach is to recognize that your goal is not to secure your assets, but to come up with a comprehensive risk management plan and to execute that to secure your assets.

In this chapter, we will explore the major elements of the risk management approach to computer security and present some basic concepts to get you started. It is not only important to ensure that your firewall is working and that it's doing its job of protecting your enterprise correctly, but also that you understand what a firewall cannot do for you. One of the worst trends we have seen in computer security is an over-reliance on firewalls and the false belief that a firewall can be relied upon to shoulder the lion's share of the work when securing a network and its assets. Too many organizations install a firewall and go no further. Firewalls are important and useful security tools, but they are not silver bullets, and they are becoming less and less effective against the growing range of threats and vectors used against protected systems.