Why is the firewall the easy part of security?
People picture a hacker as someone hammering at a firewall from a basement until it cracks. That almost never happens. If someone gets through your firewall, it usually means you didn’t do your job, because hardening a firewall is one of the easiest things in security. I ran technology and security for a national retailer for two decades, and these days I ghostwrite books for the security leaders who do this work. So I’ve seen, from both sides, where attacks come from. It’s not the place most people guard.
Too much security money follows the movie version of hacking. Executives will approve a new firewall appliance in one meeting and then argue for a year about an access review process, and the people planning attacks count on exactly that.
If a hacker gets through your firewall, that’s not a sophisticated attack. That’s you not doing the easy part of the job.Share on X
Firewall rules are among the simplest things to harden.
You close what doesn’t need to be open, you write the rules carefully, and you test them. The work is finite. There are only so many ports, only so many services, only so many rules, and once you have them right, they stay right until someone changes them.
Penetration testing isn’t optional. You pay people to attack your own systems and tell you where the holes are, then you close them. A good penetration test is among the most useful things you can buy, because it replaces your assumptions about where you’re weak with facts. You think the perimeter is solid. The pen tester proves it or breaks it, and either answer is worth the money. The mistake companies make is treating the test as a grade to pass instead of a map of what to fix.
After that, you harden your servers, and you lock down user endpoints as much as you can. That last part is getting harder, because everybody brings their own device now. The phone in your employee’s pocket is a door you don’t fully control, running software you didn’t approve, connecting to networks you’ve never seen. The endpoint used to be a company desktop bolted to a desk.
Now it’s a personal device that goes home every night and comes back in the morning, and you’re trusting it on your network either way.
Do all of that and the perimeter becomes boring, and I want it boring. The attacker then has to find another way in, and every one of the other ways runs through people.
How does social engineering get attackers in?
Once the technical defenses are solid, the easiest way into a company is to trick a human. This is social engineering, and it works because people are helpful and don’t expect to be lied to. You can spend a fortune hardening systems and a confident stranger with a clipboard walks past all of it, because no firewall screens a person who looks like they belong.
I watched one play out that I still think about.
Someone swapped out our point-of-sale terminals with their own version. The replacements looked identical, but someone built them to skim the card number and the security code off every transaction and hand them to the attacker. It was clever and it was bold. Think about the nerve it takes to physically walk into a store, replace real hardware with your own, and walk out, betting that nobody will look closely at a terminal that looks exactly like the one that was there yesterday.
An employee noticed something was off about the terminals and flagged it, and we stopped it before any real damage was done.
That’s the shape of a real attack. Not a genius cracking encryption. A person physically swapping hardware, betting that nobody would look closely. The defense was an employee who paid attention, and that’s why the human layer outweighs the technical one. I get into that fully in the human layer is where security actually breaks.
The most effective hack I saw was someone swapping our card terminals for skimmers and betting nobody would look closely.Share on X
What is an insider threat?
The vector companies miss most is also among the most common: an attacker the company hired.
Someone comes to work at your company, does the job, and works their way up into trust and access. Nobody planted them. They’re a normal employee who, over years, accumulates keys to everything. Then something changes, and the same access that made them useful makes them dangerous. Companies underrate this because it’s uncomfortable to picture a trusted colleague as the threat, and I think that discomfort is why access reviews keep sliding to the bottom of the list.
Leaving a departed employee’s account alive for six months is negligence, and I don’t accept being busy as an excuse.
It usually takes one of three shapes. The first is the disgruntled employee. They get passed over for a promotion, or reprimanded, or simply soured on the place. On the way out they take passwords with them. Or copy data. Or leave themselves a way back in. The second is the greedy one. They realize the data they can reach has value, and they sell it. Customer records, card numbers, trade secrets, whatever they can carry. The third is the one nobody likes to think about: the blackmailed employee.
Someone on the outside learns they have access and pressures them, through debt, through a secret, through a threat, into handing over what they can reach. In all three cases the damage is worse than most outside attacks, because the insider already has the keys. They don’t have to break anything. They were given access on purpose, and they’re using it for a purpose you didn’t intend. Extortion and disgruntlement do more damage than the dramatic outside hacks that make the news.
You can’t firewall your way out of this. The defense is access control, segregation of duties, and pulling access the moment someone’s role changes or they walk out the door. Nobody should reach more than their job requires, and when the job changes, the access changes that same day. Leaving a departed employee’s account alive for six months is negligence, and I don’t accept being busy as an excuse. The boring governance work is the only thing that limits what an insider can do, and nobody wants to own it.
I cover that grind in the boring security work that actually keeps you safe.
My take
Set up your firewall and move on to the people. The attacks that hurt come through people, the stranger with a story, the hardware swap nobody checks, and most of all the trusted employee who piled up keys over the years. Pull access the day a role changes. Segregate duties. Don’t let a departed employee’s account live for six months because everyone was busy. It’s negligence, and attackers count on it.
Why is ransomware really a backup problem?
Because a company with tested, offline backups restores its files instead of paying. The ransom note is worthless if you don’t need the key.
From the podcast
Cesar Dongo-Soria describes the pressure that overrides the control, and it’s not technical, on Leaders and Their Stories:
When they’re on a quarter end or year end, they have to close the deal. Regardless, they have to make the sale. The sales teams, they don’t care who they’re selling to.The quarter is the attack surface. Every control that can be waived under deadline eventually is.
I can’t talk about how attackers get in without mentioning ransomware, because we got hit early, before most people had even heard the word. It was nasty.
Ransomware encrypts your files and demands payment to unlock them. Back then, clearing it off a machine was sometimes impossible. Sometimes you just ended up with a brick. That was the word we used. Your computer is bricked. Dead weight. We used Malwarebytes to clean up in those days, though the product isn’t what it was. There are better tools now, but it’s still hard, and sometimes you still lose the machine.
The important thing to understand about ransomware is that paying doesn’t solve your problem. You’re trusting a criminal to honor a transaction, and even if they hand back the key, you now have a machine that someone who wanted to hurt you has thoroughly compromised. The only reliable defense is good backups. If an attacker encrypts your files and you have a clean copy from last night, you wipe the machine and restore.
The attacker has nothing to sell you. The ransom demand becomes a piece of spam you delete.
If your ransomware plan is to pay, you don’t have a plan. You’re funding the next attack on somebody else and keeping a machine a criminal already owned, and I’d much prefer to see that money spent on backups that get tested every month.
That’s the game with ransomware. It’s a backup problem wearing an encryption costume. Backups saved us once in a way I’ll never forget, and I tell that story in full in the piece on backups and the boring work.
Where should a security budget really go?
The pattern is always the same. Companies spend their security budget and their anxiety on the perimeter, because that’s where they imagine the threat. They buy the impressive tools and watch the firewall logs and feel protected. Meanwhile the actual threats walk in the front door as a friendly request, or sit in the next cubicle with a badge and a grudge, or arrive as an email nobody should have clicked.
Harden the technical stuff until it’s boring. Then spend your real attention on people, because people are where the attacks come from. A lot of what passes for security spending ignores this entirely, which is its own problem, and I get into the tools that look impressive and do nothing in most security tools are theater.
This is also what I try to get on the page when I work with a security leader on their book. Anyone can look up the structure. The judgment about where the real risk is comes only from experience, and a company that keeps pouring money into the perimeter while its access reviews rot is paying to fight the wrong war.
Frequently Asked Questions
Usually not through the firewall. Hardening a firewall is one of the easiest things in security, so getting breached there means the basics were skipped. The real ways in are social engineering, tricking a human, and the insider, someone hired who later takes passwords or sells data. Those are the vectors most companies underguard.
It’s when the attacker is someone you hired. They work into trust and access, then turn, usually in one of three ways: disgruntled and taking passwords on the way out, greedy and selling data, or blackmailed by someone who learned they have access. Because they already have the keys, an insider often does more damage than an outside attacker.
You can’t always prevent infection, and clearing ransomware off a machine is sometimes impossible. Paying doesn’t really help, since you’re trusting a criminal and keeping a compromised machine. The reliable defense is good backups. With a clean copy from last night, you wipe the infected machine and restore, and the ransom demand becomes spam you delete.
Because people are helpful and don’t expect to be lied to. They don’t expect the person in a uniform with a badge to be an attacker, or the caller asking for information to be hostile. The technology can be locked down, but a person can be talked into opening the door, and no firewall screens someone who looks like they belong.
Yes. A penetration test replaces your assumptions about where you’re weak with facts. You pay people to attack your own systems and tell you where the holes are, then you close them. The mistake is treating it as a grade to pass instead of a map of what to fix.
Yes. I ghostwrite books for CISOs, security founders, and technical executives. I ran enterprise security for two decades and was technical editor on Cyberheist for KnowBe4, so the engagement isn’t spent explaining the basics. You can see how I work with cybersecurity leaders on the cybersecurity ghostwriting page.
Social engineering hits homes as hard as companies. Family Cybersecurity is the book I wrote for protecting the people who live in your house from attacks that arrive through a click or a call.
