Management must not consider the installation of a firewall as the solution to all of its security problems when connected to the Internet. Firewalls provide a wide variety of control, but in the end they are only a tool. A firewall is part of a diversified defense strategy that identifies what must be protected and identifies the potential threats. It seems obvious, but there is more to protecting a network than hardware and software. Security comes from the union of superior technology, active and alert systems administrators, and management decisions regarding user access to the Internet and other computer resources.
Prudence demands the development of a comprehensive plan to deal with system security.
A working group created by technical personnel who will implement part of the policy, management who have the authority to enforce policy, and representatives of the user-community. Identify and assess the risks to those assets. A comprehensive security policy includes multiple strategies. Increasingly this is overlooked as administrators turn toward technology, and firewalls in particular, as a cure-all for their installation's security. This is a dangerous path to follow.