In the increasingly federated, network-based IT environment, perimeter security is important but not sufficient by itself to protect company secrets, according to president and principal analyst of Security Incite and former Meta Group security analyst, Mike Rothman.

Firewalls, demilitarised zones and similar boundary security technologies and methodologies are certainly still important for protecting your network from Internet-based attacks.

"The problem with depending totally on perimeter security is that it is based on the idea that all enemies are outside, and that is not always a good presumption," Rothman said. "There is a growing recognition that employees do not always do the right thing, either through malice or by accident."

And as companies increasingly partner to meet the demands of a fast-evolving, worldwide marketplace, they need to let employees of partner companies - which may also be competitors in other areas - access specific applications and data inside the corporate firewall.

Based on these realities, Rothman recommended pragmatic security, which arranges security according to different domains. The first of these is infrastructure, which focuses on the traditional areas of perimeter and physical security. The second level is data security.

Data level security

Security Levels: "Data security starts by recognising that different sets of information require different levels of security," he said. For instance, the enterprise might give external business partners access to design data for a new product they are developing jointly. It might restrict access to the corporate email system to employees, and restrict access to corporate financials and employee and customer personal information to specific individuals.

Security Policy: This defines exactly who sees what information on the enterprise network. The beauty of modern, network-based IT architectures is that all information is potentially available on the network. The problem is that all information, including information regulated by Sarbanes-Oxley and other regulations, is potentially available to anyone who can get on the network.

Compliance: In the worldwide business environment that many companies operate in today, this is a complex area because each country has its own regulations. So it's not enough for a US-based company to meet Sarbanes-Oxley and HIPAA requirements for protecting financial and personal medical information. If that entity also operates in Great Britain, for instance, it must secure employee personal information and track any access to that information to meet British laws. Even if it does not have operations in the UK, in this age of identity theft, high security for employee and customer personal information is simply good business.

Ease of Use: This is vital for good security. Without it, users won't obey security rules. Among business users, security has the bad reputation of getting in the way of accomplishing anything. Faced with having to remember complex, 50-character password strings that change monthly, users will write the passwords on sticky notes and attach them to monitors, making the passwords available to anyone who walks past their office door.