If this observation is meaningful, shouldn't it also be the case that firewall deployments aren't meaningful to enterprise security?
Because: that seems intuitively not to be the case.
To wit: on an annual site-wide pentest of any major enterprise network (this is a project every security firm does for a couple clients a year), the moment the pentester gets "behind the firewall" (ie: code execution on any application server) is invariably game-over.
If firewalls were just some stupid crap the industry made up, shouldn't they make no difference at all? Shouldn't attackers just make a beeline for wherever the high-value information is, rather than scanning the perimeter and looking for some chink to use to get behind the firewall?
My argument would be: whether firewalls are "stupid crap" or not, they certainly do seem to matter right now.
Because: that seems intuitively not to be the case.
To wit: on an annual site-wide pentest of any major enterprise network (this is a project every security firm does for a couple clients a year), the moment the pentester gets "behind the firewall" (ie: code execution on any application server) is invariably game-over.
If firewalls were just some stupid crap the industry made up, shouldn't they make no difference at all? Shouldn't attackers just make a beeline for wherever the high-value information is, rather than scanning the perimeter and looking for some chink to use to get behind the firewall?
My argument would be: whether firewalls are "stupid crap" or not, they certainly do seem to matter right now.