# The Firewall Emperor Has No Clothes

- Link: https://www.agilicus.com/firewall-emperor-has-no-clothes/
- Published: 2020-11-05T18:31:43+00:00
- Author: Don Bowman

Many people buy a network firewall and hoist a mission accomplished flag over security.
The magic box prevents the bad of the Internet from infecting the good of the interior.
But did you know the firewall itself can be taken over, or other internal resources
can be traversed, just by your own browser?

As a user, whatever your browser can get to, JavaScript running in it can get to
it. Your firewall allows all outbound. Thus if I can influence you to a site with
some bad JavaScript, I can connect to something inside. That might be the administrative
interface of your firewall. It could be your payroll system. O firewall where art
thou in my time of need?

The solution is Defense in Depth. Stop thinking about security as a perimeter, start
thinking about it as user+resource pairs. Look at a [Zero Trust](https://csrc.nist.gov/publications/detail/sp/800-207/final)
[Architecture](https://www.agilicus.com/identity-authorisation-access-microsoft-dynamics/),
its simpler than the other micro-segmentation approaches out there.