Every post in this series has had a shadow. The OSI layers trusting the layer beneath. IP addresses that locate a machine but authenticate no one. DNS that cannot verify its own answers. TCP handshakes weaponised, certificates forged, routes hijacked, local networks poisoned. Again and again we found that the thing making the internet work was also the thing that made it vulnerable, because it was built to trust.

So far we have mostly been diagnosing. Now we start treating. And the first dedicated defensive tool, the one standing quietly at the edge of nearly every network we have described, deciding what gets in and what stays out, is the firewall . We have mentioned it in passing a dozen times.…