Similarly, if such firewalling at the border is considered a substitute for end-system security, it would be better not to have the firewalling. Establish strong policies that include provisions for disconnecting hosts from the network if they do not meet basic security requirements. Back this up with pro-active probing for vulnerabilities, and a support structure to do something about it when they are found. The primary role of networks and secure network protocols is to provide reliable connectivity among hosts without unintended disclosure or modification of data. Proper access control and the use of appropriate access protocols are the responsibility of end systems, and there are no silver bullet network solutions to obviate this responsibility.
Security is maximized when the network is trusted least.
To do otherwise implies an implicit faith in the security of the local network that is generally unwarranted. The concept of building moats around entire enterprises has largely been overtaken by events. There will always be some legitimate users outside the moat, and some compromised system or attacker inside the moat. They may be an adjunct to them, but trust in network firewalls often reduces the incentive to fix the end-system security problems, and that results in reduced overall security. Some forms of packet filtering within the network infrastructure are useful, e.g blocking spoofed source addresses, and reducing the set of ports that can be used for DOS attacks can be useful where consensus can be reached on which ports are unneeded.