Many people approach information security like a sleeping night watchman. Not only that but they also proceed to stuff cotton wool in their ears.
I refer to people who configure a system (possibly even very securely) and then walk away never to revisit it. They never monitor it and place all the security worth into the fact that it was securely configured.A system is only as secure, as how well it is monitored. No monitoring = no security! A firewall does not do its job unsupervised.