A firewall is still a valuable part of the IT security stack, but businesses need to consider all their attack surfaces.