Network designs with inadequate security in place are similar to most home security models. There is a deadbolt on each door, and window locks to keep intruders away. Anyone is welcome to ring the doorbell, but must be known and trusted to be allowed inside. Once inside, a guest typically has access to most areas. They could potentially sabotage basic levels of security. There is no real record of any activity in the house, and once vacated, intruders can dig through your personal items taking whatever they please. Firewalls identify and restrict Internet guests through DMZ rules. However, conference room and data center ports lie open to anyone with a laptop. Unchanged wireless keys give temporary users access to the network forever. While attacks aren't a daily threat, the occasional security threat seeps into the network and affects hosts, servers and even the network. Basic security is present, but a major incident is completely possible.
Compare home security to the protection of a bank. While access into the parking lot is unrestricted, cameras monitor and record every part of the property. There is a 24-hour ATM that offers most services with two-factor identification. Anyone is allowed in the bank lobby during normal business hours, but experience a heightened level of security and bullet-proof restriction to the bank's assets. It is difficult to loiter or explore without arising suspicion. Monetary assets are encased further in the most solidified and secured area in the entire building. Access to the vault requires a person to pass through several different areas, being monitored before authentication is ever requested. This is the shape of a well-secured network. An intrusion prevention system (IPS) implemented at several levels of the network acts like a security camera system, providing traffic monitoring needed to accurately deter, detect and record most attacks. Firewalls, like bank tellers, verify identity but also restrict access to only those services that the bank is willing to offer you. The teller also records your transactions when giving you physical or virtual access to the vault, in the same way that traffic flow statistics and security solutions can provide the same type of accounting. Any hint of malicious activity in the facility results in immediate reaction and notification of the proper authorities. As your network grows, consider the different areas of your network and how access is controlled and monitored between them.
