2 quote the 1st to analyze the High Sierra vuln
source | link

To maintain up to date a firewall and to maintain up to date softwares are 2 independant lines of defense

In short, the answer to your question can't be yes or no, both are wrong.

And here are some explanations why:

  • A "perfect" firewall (this model doesn't exist) and even a completly isolated intranet (i.e. with not a connection to the Internet) doesn't protect your systems against the connection within this highly protected intranet of a contaminated or attack computer. (This a real life feedback : ~ one such attack from the inside / year). See also Stuxnet (2010, analysed by Kaspersky Lab.).

    In short even a "perfect" firewall can't protect you against the major risk from the inside.

  • On the other extrem of the spectrum of evil events, an upgrade of an OS or a software isn't the guarantee of an improve of security. Most upgrades of software are increases in number of lines of codes and the probabilities law tells us that the number of bugs increases proportionally. An OS upgrade may open a vulnerability on port 80/tcp (http) inside Apache which wasn't present within the previous version. And as is the case on many firewall configuration, this protocol might be legitimatly permitted to enter your network. Then your OS upgrade might cause a serious vulnerability within your whole network. See also rootremote root access vulnerability created by upgrading to MacOS High Sierra (2017, analysed by Lemi Orhan Ergin).

    In short, even a "perfect" practice of "always update" can't protect you against the major risk of editors bugs in front of an open port of your firewall.

There are many other scenarii to demonstrate that none of these 2 approaches is sufficient: the "perfect" firewall, the "perfect" upgrade practice.

So what should I do?

My personal advice it to maintain firewalls and softwares up to date independantly after a minimum checking that none of them is introducing a vulnerability which the other isn't prepared to defend against.

To maintain up to date a firewall and to maintain up to date softwares are 2 independant lines of defense

In short, the answer to your question can't be yes or no, both are wrong.

And here are some explanations why:

  • A "perfect" firewall (this model doesn't exist) and even a completly isolated intranet (i.e. with not a connection to the Internet) doesn't protect your systems against the connection within this highly protected intranet of a contaminated or attack computer. (This a real life feedback : ~ one such attack from the inside / year). See also Stuxnet (2010, analysed by Kaspersky Lab.).

    In short even a "perfect" firewall can't protect you against the major risk from the inside.

  • On the other extrem of the spectrum of evil events, an upgrade of an OS or a software isn't the guarantee of an improve of security. Most upgrades of software are increases in number of lines of codes and the probabilities law tells us that the number of bugs increases proportionally. An OS upgrade may open a vulnerability on port 80/tcp (http) inside Apache which wasn't present within the previous version. And as is the case on many firewall configuration, this protocol might be legitimatly permitted to enter your network. Then your OS upgrade might cause a serious vulnerability within your whole network. See also root access vulnerability created by upgrading to MacOS High Sierra.

    In short, even a "perfect" practice of "always update" can't protect you against the major risk of editors bugs in front of an open port of your firewall.

There are many other scenarii to demonstrate that none of these 2 approaches is sufficient: the "perfect" firewall, the "perfect" upgrade practice.

So what should I do?

My personal advice it to maintain firewalls and softwares up to date independantly after a minimum checking that none of them is introducing a vulnerability which the other isn't prepared to defend against.

To maintain up to date a firewall and to maintain up to date softwares are 2 independant lines of defense

In short, the answer to your question can't be yes or no, both are wrong.

And here are some explanations why:

  • A "perfect" firewall (this model doesn't exist) and even a completly isolated intranet (i.e. with not a connection to the Internet) doesn't protect your systems against the connection within this highly protected intranet of a contaminated or attack computer. (This a real life feedback : ~ one such attack from the inside / year). See also Stuxnet (2010, analysed by Kaspersky Lab.).

    In short even a "perfect" firewall can't protect you against the major risk from the inside.

  • On the other extrem of the spectrum of evil events, an upgrade of an OS or a software isn't the guarantee of an improve of security. Most upgrades of software are increases in number of lines of codes and the probabilities law tells us that the number of bugs increases proportionally. An OS upgrade may open a vulnerability on port 80/tcp (http) inside Apache which wasn't present within the previous version. And as is the case on many firewall configuration, this protocol might be legitimatly permitted to enter your network. Then your OS upgrade might cause a serious vulnerability within your whole network. See also remote root access vulnerability by upgrading to MacOS High Sierra (2017, analysed by Lemi Orhan Ergin).

    In short, even a "perfect" practice of "always update" can't protect you against the major risk of editors bugs in front of an open port of your firewall.

There are many other scenarii to demonstrate that none of these 2 approaches is sufficient: the "perfect" firewall, the "perfect" upgrade practice.

So what should I do?

My personal advice it to maintain firewalls and softwares up to date independantly after a minimum checking that none of them is introducing a vulnerability which the other isn't prepared to defend against.

1
source | link

To maintain up to date a firewall and to maintain up to date softwares are 2 independant lines of defense

In short, the answer to your question can't be yes or no, both are wrong.

And here are some explanations why:

  • A "perfect" firewall (this model doesn't exist) and even a completly isolated intranet (i.e. with not a connection to the Internet) doesn't protect your systems against the connection within this highly protected intranet of a contaminated or attack computer. (This a real life feedback : ~ one such attack from the inside / year). See also Stuxnet (2010, analysed by Kaspersky Lab.).

    In short even a "perfect" firewall can't protect you against the major risk from the inside.

  • On the other extrem of the spectrum of evil events, an upgrade of an OS or a software isn't the guarantee of an improve of security. Most upgrades of software are increases in number of lines of codes and the probabilities law tells us that the number of bugs increases proportionally. An OS upgrade may open a vulnerability on port 80/tcp (http) inside Apache which wasn't present within the previous version. And as is the case on many firewall configuration, this protocol might be legitimatly permitted to enter your network. Then your OS upgrade might cause a serious vulnerability within your whole network. See also root access vulnerability created by upgrading to MacOS High Sierra.

    In short, even a "perfect" practice of "always update" can't protect you against the major risk of editors bugs in front of an open port of your firewall.

There are many other scenarii to demonstrate that none of these 2 approaches is sufficient: the "perfect" firewall, the "perfect" upgrade practice.

So what should I do?

My personal advice it to maintain firewalls and softwares up to date independantly after a minimum checking that none of them is introducing a vulnerability which the other isn't prepared to defend against.