Unfortunately, firewalls have serious limitations. Since a firewall does
not restrict communication between hosts that are inside the firewall, the
adversary who does manage to run code internal to a site can access all
local hosts. How might an adversary get inside the firewall? The adversary
could be a disgruntled employee with legitimate access, or the adversary’s
software could be hidden in some software installed from a CD or downloaded
from the Web. It might be possible to bypass the firewall by using
wireless communication or dial-up connections.