All firewalls are not created equal (Windows)

Sure, you have a firewall, but is it giving you all the protection you need? Traditional packet filtering firewalls can only block traffic based on IP addresses and ports (at the Network and Transport layers of the OSI model). Savvy modern attackers can bring down your system or network by exploiting application layer protocols.

To protect against these attacks on your Windows computer, you need a firewall that supports application layer filtering (ALF). The problem is that ALF is slow and resource intensive. Consequently, you might want to deploy multiple firewalls, with a fast packet filtering firewall at the internet edge and an ALF firewall on the "back end" of your DMZ.