With respect to firewalls, anything that stops access to ports is good, however they need to be adequately set up. There is a firewall project which is initially aiming at protecting the SAP systems. With SSH each machine must have a host key. It enables recovery of a system when everything is forgotten. It is a potential security problem.
Every execution is vulnerable.
A service can be denied, a web server can crash, root access can be given. Different pages, the main Monash web server, are not being checked out on a regular basis to check on vulnerabilities as the environment has been locked down. Specific vulnerabilities are not checked and there is no checking on live day to day running issues. The more vulnerable areas are configured so that they are less vulnerable. Part of the general policy is to get people to use university based web services rather than their own.