TL;DR
You absolutely need more security devices and mechanisms put in than just an ACL, this is not sufficient at all, security is best done in a layered approach an ACL on a router is simply one layer you should have many, many more.
Based on what you've said, your security is pretty poor and for what kind of data you're handling there is no excuse.
Access-Control Lists where originally built to be a security function, they provide a nice base level of security, however, they are nowhere near the level of what a firewall can do for you. ACLs tend to be used nicely for segregating at layers 2 & 3 (Yes you can put ACLs on switches on things like the VTY lines, etc).
Standard ACLs
Standard ACLs provide a very limited feature, they can only permit or deny traffic based on the source address this can be useful however as I said very limited and don't tend to be used as much as an extended ACL.
Extended ACLs
Extended ACLs do provide a few extra features compared to a standard ACL, it's still not a firewall however extended ACLs can permit or deny traffic based on source address, destination address and port numbers.
Another thing you can be done at layer 2 is port-security, port-security on your switches is always a good idea if your cab is somewhat accessible and you know that the devices that go in certain switch ports will stay there and there is no reason for someone to need to unplug it and plug another device in. Without going too complex port-security allows things such as MAC address filtering whereby only a specific MAC address is allowed to communicate on that port and if the rule is violated an action takes place such as the interface being err-disabled so no further traffic can pass-through.
Firewalls
You may now be wondering what the benefits of a firewall are and one of the best things about them (especially top-end firewalls) is how granular you can be with rules. A few features to think about, granular access-rules, deep packet inspection & filtering, etc. Most firewalls will do the same sort of thing, however, the really high-end ones will have more features it just depends what you go with, recently I've seen a lot more implementations with virtual firewalls on customers networks which is interesting to manage.
IPS & IDS
It's common to see an IPS/IDS built into a firewall today especially on Next-Generation Firewalls, however, I'll talk about these separately.
An IPS is like a firewall in the sense that it does access-control however it does it the other way round to a firewall. A firewall allows access via permit statements and has an implicit deny if it's not matched whereas an IPS will have deny rules if a packet doesn't hit any of those deny rules it will permit.
An IDS is slightly different from an IPS, in that it analyses the security of a network, IDS can be incredibly powerful in helping engineers figure out where issues are sourcing from. Below is a list of things an IDS will typically do.
- Security policy violations
- Infection scanning
- Information leakage
- Configuration errors
- Unauthorised clients
Summary
The ability to access this information at the click of a few buttons is incredibly powerful and something you absolutely won't get from an access-list. As mentioned, security is best done in a layered approach - access-lists are very good for segregation but if you want a true insight into what's going on, on your network and where the issues lie you need more than just access-lists and even more than a firewall.
Some firewalls come with a built-in IPS/IDS which is great because it solves the need of having three physical devices (if you're not using any virtualization) which not that ago, this was not an option.
When handling data such as the data you're handling you should be protecting the network at all points not at one point. Ideally, you want to take advantage of access-lists, port-security, firewalls, IPS, IDS and more.
