I know some people that, in regards to network security, argue that because the firewall on the router into the building is on, that makes the network secure and therefore, the firewall on Windows PC's can be switched off. These people work in IT.

I disagree with this and I need a solid argument to go back with. I am thinking that, if a computer on the network becomes compromised with malware, then an attacker taking control of this computer has already gotten past the routers firewall, and because the Windows firewalls are switched off they can then stroll through our LAN accessing any computer they wish.

Firstly, is my analysis correct? Secondly, what would you add to/remove from the argument I have presented above?

  • 5
    That's correct. Also mention the fact that some of the most malicious attacks on a network come from the inside. Also, Defense in Depth
    – resmon6
    Commented Feb 21, 2012 at 17:47
  • 2
    The people you are talking about that say what you claim they say are in no certain terms complete and total idiots. Your solid argument is that they are idiots. The hardware firewall, hardware router, and software Firewall all do different things and were designed to do different things. Of course once a computer is infected even with a firewall its unlikely to help. Many other tools should be used BEFORE that happens, Windows Firewall is the very last defense you have, and it shold always be on.
    – Ramhound
    Commented Feb 21, 2012 at 19:32
  • 4
    That's like saying you should leave the restroom stall door open because the main building doors have locks.
    – Sonic42
    Commented Feb 21, 2012 at 22:19

4 Answers 4


Your argument is a very good one. I agree with you.

If it is too abstract for your IT folks, here is a way to make it more concrete. Suppose one of your fellow employees catches a virus/worm while travelling, then brings his/her laptop back and connects it to your company network. The worm will then be free to spread within your company network, without any firewall to stop it. I have seen this happen in practice several times, and it is painful.

It is possible that your IT staff are concerned about the support cost of dealing with the firewall, and are worried it might break functionality and trigger more support calls to the IT folks. Keep in mind that if your company deploys a local firewall on all your Window PC's, it is the IT staff who will have to deal with any increased level of support. So their concerns may be legitimate.

If it were me making the decision, I think I would look at what are the downsides of running a firewall on your Window PC's. If a local firewall would disrupt access to critical systems or would interfere with your business's core mission, then I would not run a local firewall: I would look for some other way to protect the internal machines. However, if in your situation the local firewall wouldn't disrupt employees use of computing and wouldn't incur unreasonable support costs, I would enable the local firewall.

If people are unsure, you could start with a pilot: enabling the local firewall on a handful of Window PC's (maybe the ones handling the most critical information: e.g., payroll, or core intellectual property) and then track whether it causes problems. The pilot could then give your company useful information to decide whether to enable the local firewall throughout the rest of the organization.

  • Thanks for the reply. To give you some background, it's a small company, I'm the developer and the firewall on my PC (Comodo) is always on. The systems guys want me to turn it off so they can get Spiceworks working and I was presented with this argument when I protested so thought I would ask you guys to see if I was missing something.
    – JMK
    Commented Feb 21, 2012 at 20:02
  • 6
    Compromise with them and ask what port Spiceworks needs to have open in order to communicate with your computer. As others have said, it's better to have it on then off.
    – Safado
    Commented Feb 21, 2012 at 20:30

Malware can enter an organization in many ways, such as email attachments and malicious web sites, or a USB stick brought in from home. Conficker was able to spread from computer to computer within an organization. Defense in depth as previously mentioned is a best practice to ensure the protection of the organization. Make sure all computers are regularly patched (Microsoft, as well as Adobe & Java), use antivirus and keep it up to date, and use both perimeter and individual firewall protection.


In addition to what's been said before, I think it's important to note that the type of firewall might actually differ. If the perimeter firewall is stateless the protection provided by the stateful firewall on your desktop can add to the stateless protection of the perimeter (e.g. as it can use knowledge of the processes initiating a connection to judge the return traffic destined for this process).


I always say there is NO such thing as protection against Zero Day, so think designing everything in layers. The firewall has IDS and say Kaspersky AV, the systems have Sophos with it's firewall turned on and ONLY allowing the traffic needed to do the job. Block known sites both as a content filter on the gateway and also deploy hosts files on the local machines routing trash traffic to Everything can be designed in laters utilizing different vendors technologies (kaspersky [firewall] and sophos [local machine] hosts file [lowest software layer]) to make it MORE difficult to get infected or compromised. Lastly, sniff your own network to make sure nothing weird is going on and only your machines and MAC addresses are on it.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .