Brian Gammage, research vice-president at Gartner, highlighted Microsoft's decision last month that its Microsoft's next Windows operating system, Longhorn, which had been expected in 2006, will not offer full security features for another two years.
Longhorn will incorporate the results of an industry-wide initiative to create PCs capable of running programs in isolation from each other. The concept, called "protected execution", will mean hackers or worms attacking vulnerabilities in one piece of software will not be able to infiltrate the rest of the PC or the network.
Until the technology becomes available, IT departments have no choice but to work increasingly hard to keep ahead of attackers, said Gammage. "Up to two-thirds of critical business data can be found on PCs. That is way too much. Bring it back in house. It does not need to be there," he said.
Businesses need to develop policies to protect their networks as an increasing number of employees are using laptops and remote mobile devices.
IT departments need to move to standard configurations to simplify patching, said Gammage. "If you do not know what is in your PC environment, it is going to make you vulnerable," he said.
Firms without a standard PC configuration have to test patches on all the desktop configurations in their organisation, which has cost and security implications.
"We have no excuses. Five years ago we were worried about Y2K. We created detailed asset registers. But what happened after 2000? We stopped using them."