Many in IT then and now think security was the domain of people who managed routers and proxies (also responsible from preventing non-approved use, like too muc

Many in IT then and now think security was the domain of people who managed routers and proxies (also responsible from preventing non-approved use, like too much downloading or reading bad things) and IT minions who install an anti-virus. From the network perspective, they block 'malicious' javascript (impossible!) and bad websites (outsourced of course) and they block all ports and websites they can in a constant struggle against actual business needs. These people are doing what they can, but it mostly involves buying snake oil because they don't understand software. The idea of running someone else's code (javascript, flash, macros) on the same box as the confidential data, i.e. the end user box, is completely mad when sandboxing technology is still in its infancy. Letting unverified parsers touch untrusted data is mad too, but confining everything (SELinux style) is too hard for most. But why do we let these parsers talk to the network? Why can't I prevent my android/iOS apps from talking to any site on the internet? We need a sea change in expectation from users (corporate and individual) that their data won't leave their box without them knowing about it, that it will be authenticated and encrypted in transit, who will demand operating systems support for enforcing this, and demand that their applications are written to expect only limited and mediated access to the network, file system and kernel.