Cathy,

Great points in your article. From my experience, many companies have tried to force security into their networks after the fact, rather than during the initial design. That being said, modifying an existing 'flat' network requires work that most companies will not undertake until they have been given a reason, unfortunately, that reason is often a security breach that is costly to recover from.

The redesign of the network to 'compartmentalize' the different groups and access controls utilizes rather simple techniques that most if not all network devices sold today can accommodate. Network features such as VLAN's, Subnets, ACL's have existed for many years, but are NOT utilized by many companies because the initial designs did not consider security as a key feature to the design.

We can not, and should not place all the blame on our firewalls, virus detection solutions, or IPS devices. How we design our networks, locate our security defenses, and configure these devices are just as critical and responsible for the overall security of our networks. Unfortunately, network design is often neglected as a key component to overall security.