Responses to Threats: Cybersecurity in 2024: Lessons From the Trenches

I’m writing this just after the third coffee — still beepboop from DEF CON, still digesting all those conversations I had with companies that were wrestling making sure they had their cybersecurity act together. Some things never change.

When I was a network admin back in ’93, security was easy (or, at least, we thought so). Keep the firewall open, require strong passwords, and perhaps — just perhaps — you wouldn’t wake up to a breach. Roll on today, and security is far from straightforward.

I’ve witnessed it all in the last 30 years: the Slammer Worm eating its way through networks like a wildfire to the ransomware gangs of today operating multi-million-dollar extortion rackets. And here’s the thing — most businesses continue to make the same basic mistakes.

Cybersafety Is Still Falling Short Where It Counts: Quick Take

If you have a minute, read on:

Zero-trust is no longer optional. I just assisted three banks in completely overhauling their architecture due to being compromised through a trust but verify model.
Ransomware is not going away; it’s adapting. Hacking attacks that once landed on small businesses are crashing into enterprises deployed with military-grade techniques.
Just a firewall is not enough. If you are under the impression that providing a perimeter firewall is that special ingredient for protection, good luck (you’re going to need it).
“AI-powered” security tools are not a magic bullet. Marketing owns these buzzwords, but in reality, these tools are simply glorified pattern matching in the most part.

Let’s dig into this.

The Toughest Upgrade No One Wants to Do: Zero-Trust Architecture

I get it. Zero-trust is exhausting. “Basically it means getting rid of that castle-and-moat model (which, by the way, never really functioned) and assuming every connection is a potential threat—even inside your network.

A few months ago, I consulted for three banks that believed they had zero-trust. Turns out, they had a slightly more strict role-based access. That’s not zero-trust—it’s hopeful thinking.

The real deal? Zero-trust means:

Verify every user, every device, every request. No automatic access anywhere — not even for the CEO.
Micro-segment, micro-segment, micro-segment. If malware can get into one system, it should not be able to crawl into everything else.
Everything is logged and monitored. If you’re not looking for anomalies, you are compromised, you just don’t know it yet.

Sure, it’s a hassle to put in place — but it’s a better pain than cleaning up after an attack.

So about ransomware in 2024: They’re Not Just Locking Up Files Anymore

Ransomware gangs have changed. It used to be, they’d lock up your files and ask for Bitcoin. But now? That’s just step one.

Double extortion: They don’t just encrypt your files, they steal your data — and threaten to leak it if you don’t pay.
Triple extortion: They are one step ahead, targeting your customers and partners as well.
Persistence tactics: Old school ransomware made its move quickly and departed. Today, attackers roam your network for months before launching an attack.

A client I helped believed their backups would rescue them. Except the attackers had been inside for weeks, corrupting those backups with a layer of stealth. When ransomware struck, the backups were worthless.

The ugly truth? Currently, the only real option is prevention. That means:

Endpoint detection and response (EDR) Antivirus is no longer enough—you need real-time threat hunting.
Air-gapped backups. If the attacker can reach your backups over the network they will obliterate it.
User education. Phishing is still the 1 way in. With employees not sceptical of every single email, you are already under threat.

The Most Likely Thing You’re Doing Wrong With Firewalls, Servers, Routers

I see this all the time. Businesses will purchase enterprise-grade firewalls, servers and routers… only to configure them in ways that help attackers.

Default credentials are still around in production. (Seriously?)
Firewall rules are a mess. Even half the time, businesses don’t even know what needs to get inside. They send everything back until they make things work.
Unpatched firmware. If your firewall is operating a two-year-old version with known exploits, it isn’t secure.

Look, I enjoy firewalls — but they’re not magic. If you don’t set them up properly and keep them up-to-date, they’re just dusty paperweights.

The Power of AI For Cybersecurity in 2024 Is Overhyped

Now here’s a hot take. As for security, I am not trusting any solution simply because it is marked AI-powered on the box (or its marketing bullcrap).

Here’s why:

AI and ML models can’t perform arbitrary tasks on arbitrary datasets. “If they have never seen a particular kind of attack before, they may not catch it at all.
Attackers are adapting too. They are employing machine learning to avoid defenses. It’s an arms race.
“AI detection” models are mostly glorified pattern-matching. Fancy? Sure. Revolutionary? No.

I’m not going to say that AI has no place in security—but I will say that it isn’t the silver bullet the vendors would have you believe it is.

Lessons From DEF CON: Hardware Security Is the New Frontier

I’m still recovering from DEF CON, and one thing that struck me: Hardware hacking isn’t getting enough love.

As we’re all tuned into software vulnerabilities, crooks are taking aim at:

Router firmware attack – If an attacker deploys malicious firmware in your router, they have taken over your network.
Supply chain attacks – purchasing hardware from untrusted sources? Hope you’re cool with secret back doors.
IoT (Internet of Threats) — cheap, insecure devices are connecting to corporate networks all over the place.

Most companies don’t even consider hardware security until it’s too late. But trust me: You should.

Final Thoughts: The Issues We Are Still Ignoring

If there’s one what I’ve learned in my career, it’s this — MOST security breaches aren’t the result of some super-sophisticated, nation-state level attack. They happen because:

Someone clicked a bad link.
A factory password is never replaced.
A misconfigured rule in the firewall went unnoticed.

Fancy AI? Next-gen firewalls? Advanced threat hunting? They all help. But if you don’t have your basics locked in, none of that matters.

So, here’s my no-BS advice:

Implement true zero-trust. Not only in theory — enforce it, in practice.
Lock down your backups. Because that is what ransomware will be after.
Take hardware security just as seriously as software security. Because attackers are already doing so.
Don’t believe AI hype. It’s a tool—not a solution.
Fix the easy stuff first. Because that’s where the most breaches begin.

Security is not about chasing the latest new buzzword. It’s about doing something to repair the things that keep getting exploited. And honestly? The majority of companies aren’t doing that.

Let’s change that.

Blog