We see such measures in modern cities only during war, and even then they are broadly condemned because of the civilian suffering they cause. So, if this example is instructive for information security, modern corporations can not sustain a "hard" perimeter any more than a modern city can. Yet if we look at the security architecture of most companies, we seem to try to ignore the fact that "many connections" is not just a change in degree from "one connection" but a fundamental change in kind.

A biological example helps to demonstrate this. Assume there is an outbreak of disease. Would we attempt to construct a large plastic bubble to envelop Chicago? Or would we instead depend on individual immunity and vaccination to protect the residents? A bubble has the same problems as a perimeter: The insiders starve because of the lack of trade, and the bug always gets through anyway. Maximum downside, not much upside.

The unifying theme is the same: We cannot depend on architectural solutions for security in a corporate world where connectivity and mobility are ubiquitous. Those who fail to see that networks have fundamentally changed still are trying to adapt perimeter security to this new reality. The new reality, however, calls for individual immunity -- every server, desktop, smart phone, router and network device needs to carry a strong set of defenses.

Security must be distributed, ubiquitous and pervasive. It's either that or you end up huddled inside the bubble, starving for lack of trade and deluded into hoping nothing gets through.