What we need now is a fundamental shift in our approach to IT security -- one that takes an information-centric view of security.