The computer security field is replete with metaphors?the original and most commonly used metaphor is the computer (or network) as a fortress, the walls of which must be guarded against potential breaches. This metaphor is useful, but like all metaphors, it is not precise. Understanding the differences between the metaphor of a fortress, and the realities of securing a system, is crucial to students understanding the subtleties of computer security. In this column, we discuss the fortress metaphor as a pedagogical tool, both how it succeeds and how it fails to aid student understanding.