IT security needs a new metaphor