When I did firewall/network support for managed hosting customers, the number of customers' custom/vendor apps that were vulnerable (and exploited!) by SQL injection attacks was astounding. Of course the very first thing they said was "but we have a firewall, why can't you ACL it?" Sorry, your Cisco ASA doesn't work that way. It's like people never expected their code to run in a hostile world.