I am an information security intern for a MSP.
The company is set up to work remotely a few days a week. As I was gathering information for the assessment, I found out that one of the employees does not have a packet filtering firewall. She is running a Cisco Umbrella DNS agent and an SSL VPN when working remotely. She is adamant about telling me that she does not need a firewall because of the DNS agent and SSL VPN.
I always learned it was necessary to have a perimeter firewall to manage traffic. How can I articulate why she needs a firewall along with the other security controls?