Remember the old M&M analogy - security is like an M&M candy, hard shell on the outside, soft on the inside. In other words, put up firewalls, built a strong perimeter and you're good to go. Of course, nobody believes that M&M-type security is sufficient in today's world of insider threats, data leakage, mobile workers, thumb drives and sophisticated malware. So, what's the new metaphor? We asked around and came up with a number of interesting and useful ways to think about enterprise security.

Security is like a stack of Swiss cheese

Each slice covers up holes in the slices below it. By Jeremiah Grossman, CTO, Whitehat Security.

Traditional enterprise security is viewed as a hard outer shell protecting a soft interior, but today's Web 2.0 era has changed all that. The perimeter has become porous with applications and access control shared deep between enterprises and consumers. In this way enterprise security can be best viewed like a stack of Swiss cheese. No single layer of security is impenetrable; each protects certain areas and misses others. In a layered approach each slice (defense-in-depth) attempts to cover up the holes in the one below it.

Security is a fortified castle

Defenses are needed on the perimeter and inside. By Ryan Sherstobitoff, Panda Security.

Today's threats are designed to evade multiple layers of defense and the M&M metaphor no longer applies. Emerging threats are able to bypass current perimeter defenses (the shell) and invade end-points because the vector has changed. This perimeter-based model worked years ago during the days of network worms, network based attacks, when they were easily stopped by blocking ports. When talking about network security today, both a perimeter and a converged end-point approach, including many different technologies (antivirus, data leak prevention, system hardening, disk encryption, behavioral blocking, behavioral analysis, firewall and NAC) that inspect and prevent at multiple layers is key.

Security is like a primary care physician

Coverage needs to extend from cradle to grave. By Becky Bace, Trident Capital.

The body of knowledge associated with system security/risk management has grown explosively over the past couple of decades and we're at a generational juncture. It's time for us as a profession to acknowledge this and to adjust our definition of roles and requisite expertise accordingly. I use the analogy of healthcare to describe where we are and where we might want to go. The notion of primary care provider (i.e. family/personal physician) is core here, with qualifications determined by not only how well the person understands core concepts of security, but also how well the person understands the system (and associated business) to be protected. I also propose that we define and provide some way of rigorously assessing and certifying specialists who would be called in when an issue falling within their specialty arose. One of the points of this analogy that I like the most is the notion of specialty coverage from womb (obstetrics) to undertaker (forensic pathology), for good security has that level and range of involvement.