Our most positive experience has been other people's break-ins. We saw three network break-ins in our building over a three month period. We have not observed any break-ins through our firewall in that period, but the firewall also has a downside. To date, we have spent more time developing our firewall than we would have spent recovering from those break-ins. Our firewall policy has evolved over nearly two years, and we expect this evolution to continue.
Evolution occurs because of three forces.
First, new security concerns arise, whether as a result of CERT advisories, recent breakins at other sites, or even penetration of one's own site. Second, application requirements change over time. When a new networked application becomes commonplace, the firewall's packet filters must eventually be extended to support the new protocol. One might also eliminate support for applications that are no longer widely used. Third, user access requirements change.