Boundary firewalls and internet gateways

Every device connected to the internet should sit behind a properly configured firewall, or an equivalent network device, that controls traffic in and out.

What "properly configured" means

• Change any default administrative password to something strong and unique, immediately.
• Prevent access to the firewall's administrative interface from the internet, unless there's a documented business need, and even then, protect it with MFA or an IP allow-list.
• Block unauthenticated inbound connections by default, and only open ports and services that have a clear, documented business justification.
• Remove or disable any firewall rules that are no longer needed as soon as they're identified.

A firewall with its factory-default password, or with every port left open "just in case," provides very little real protection, regardless of how expensive the hardware was.