IT's security model is outmoded, the chief information officer of oil company BP has said.
Patch cycles are now too long, the end result of which is that the old-fashioned, centralised network has been turned into worm fodder, Dr Paul Dorey suggested at a Sydney conference.
The old perimeters of a corporation protected by a firewall no longer exist because companies can no longer define where their borders end, particularly when dealing with business partners.
"One moment an organisation is a competitor and the next collaborates on a project; not being able to determine the edge or perimeter is a ghastly problem for security people," Dorey said, adding that firewalls were not the solution.
More enterprise desktops should be online because companies should not rely on the corporate network for security, he said.
"Clients should be put online with servers placed in armoured, segregated areas separate from the network," he said.
This is necessary to keep the network simple by avoiding application clutter so patch updates happen immediately, he said.
Dorey, who is also UK chair of the Institute of Information Security Professionals (IISP), delivered the keynote address at the Australian IT Security Summit in Sydney last week.
"Most corporations say they have a four-day patch cycle but this should really be four minutes or four seconds," he said.
"Companies patch 85 percent of their network really well, but a real challenge is to get that last percentage of clients.
"We have around 65,000 clients and 300,000 nodes globally and it is hard to get a hold of [patch cycles]."
Increased wireless access points, nonexistent perimeter security make organisations more open to attack, he said.
"People see firewalls as just speed bumps to regulate traffic, not for protection," Dorey said.
Three trends that will change Internet security over the next four years include the Jehrico Forum, (a global user community devoted to promoting open standards in security), accreditation through the IISP and the control systems certification.