Any security solution is incomplete unless it begins with a complete Risk Assessment. A Risk Assessment is a methodology designed to completely evaluate the current state of a companies Security Posture and Awareness. Once an assessment has been completed, there will be an understanding of existing risks. These risks are evaluated, then procedures are implemented to ensuring that information cannot be compromised or improperly accessed, modified or deleted. Throughout this process, the focus is on information CIA, or Confidentiality, Integrity, and Availability.
Confidentiality concerns the prevention of unauthorized disclosure of information.
Information Integrity must be protected to ensure there are no unauthorized changes, and that it is reliable and accurate. Information Availability means that it must be available when required. It's important to understand this aspect of security because a company that tells you a firewall makes you safe is not addressing all these aspects. They are, therefore, giving you a false sense of security. A firewall, by itself, is a partial measure to mitigate the risk to the Integrity of your information, but it does nothing to address risks of Confidentiality or Availability.