The Hard Truth About Cybersecurity—Lessons from the Trenches

Written By: The Hard Truth About Cybersecurity—Lessons from the Trenches

I’ve been around long enough to witness the rise and fall of many a security trend. Back in my early days as a network admin in ’93 (I was configuring multiplexers for voice and data over PSTN as my daily grind), and today as a small business owner that runs a cybersecurity firm, I have had a front row seat to some of the most significant transitions in security. And I’ll tell you—some things are constant.

Too many organizations still treat security as an afterthought. For expediency, rogue employees continue to circumvent policies. Attackers are still taking advantage of the same basic vulnerabilities. The only thing that’s changed is the sophistication of the threats — and the marketing buzzwords vendors use to sell half-baked solutions. This is why I still love (and hate) this line of work. Because every time you think we’ve locked things down, there’s another way to break in. Let’s discuss some real world lessons I’ve been given over the past few weeks, and what they mean to your security posture today.

Quick Take: Three Minutes on Security Insights

• Zero Trust is not a product — three banks I’ve upgraded learnt me to help most organizations are got it wrong.
• Passwords are still the weakest link – yes, even in 2024. Oh, and your employees are still using Password123.
• AI in security? More hype than heat — for now. You should not be fooled by the hype.
• Hardware hacking is a sleeping giant — just got back from DefCon, and let’s just say… you should be worried.

The Zero Trust Reality Check

A few months ago, I was working with three banks on improving their security posture. They all asked for the same thing: “We need Zero Trust.” Here’s the issue—most IT teams think Zero Trust is some magic product that they can just purchase, plug it in, and it just works. That’s not how it works.

Zero Trust is not a technology but rather a philosophy — a security model that assumes that nothing inside or outside of your network can be trusted.

Properly implementing it means:

• Continuous verification. The user’s access is re-evaluated each time they request it.
• Least privilege access. Provide Least Privilege: Employees, services, even system admins receive only the minimal permissions necessary.
• Microsegmentation. Segregating networks so an attacker cannot move horizontally.

Otherwise, let me be straight with you — if all you’re doing is sprinkling an identity management tool and deciding that you’ve got Zero Trust, you’re wasting time and money. Real Zero Trust requires effort — reimagining infrastructure, policies, and even the way your users behave.

The Password Debacle — It Continues to be Terrible

We still don’t take passwords seriously. Passwords are always step one and I don’t care how many MFA solutions we bolt on. And it’s the first step where people stumble.

Employees use common passwords for work and personal accounts (99% of breaches begin this way).

• They enter passwords into phishing pages even when trained not to (muscle memory is a killer).
• IT managers impose rules so absurdly complex that employees have to transcribe them on sticky notes (secure? Nope).

Here’s the reality — if your password policy hasn’t improved since 2005, then you’re already compromised. These days, complexity requirements don’t prevent a breach. What works?

• Passphrases over passwords. A sentence that you can always remember is better than a short string of gibberish.
• Password managers. Sure they have risks, but at least they’re better than the alternative (reuse & weak passwords).
• FIDO2 authentication. If you seriously care about security, it’s time to go password-less, full stop.

And no, requiring employees to change passwords every 90 days doesn’t make a difference. It only makes them predictable.

AI Security: Hype > Delivery

AI-powered threat detection. AI-driven security analytics. AI-this, AI-that.

Look, I’ve tried a ton of these AI solutions. My verdict: Marketers love AI more than attackers fear it.

Most security AI is just reskinned pattern matching with a glossy front end. It’s good at spotting low-hanging fruit, but I have yet to meet an AI tool that can outthink a human attacker. An adversary has already been testing and poisoning AI models with an adversarial attack, and the security industry isn’t keeping up.

AI in security has potential. But today? Don’t stake your organization’s defense on it.

A Hardware Hacking WakeUp Call

Just returned from DefCon, brain still tingling from the hardware hacker village. Each year, I come away more paranoid than the last.

The overall theme this year was supply chain threats — that is, how attackers can tweak hardware long before it is ever handed over to you. I witnessed demonstrations in which researchers inserted tiny backdoor chips into enterprise routers — undetectable by conventional firmware checks.

Here’s the scary part:

• Many supply chain attacks are not even detected. How would you even know if someone was modifying your hardware before it shipped to you?
• Attacks on the firmware level are on the rise. Once it’s in your firmware, getting malware out is nearly impossible without the replacement of hardware.
• This is not being audited properly. Security teams become paranoid about software, but as it turns out, insecure hardware invalidates all security.

Bottom line? Begin contemplating hardware security. Everything from network appliances to routers to your office printers could be a ticking time bomb.

What Can You Do Today?

Cybersecurity can be intimidating — and it is. Attackers need just one way in. We have to defend everything. But if there’s one thing that I’ve learned, it’s that action defeats worrying.

If I were you, here’s what I’d do:

• Require passphrases and MFA. Get rid of complexity rules from the past—they are not effective.
• Evaluate your supply chain security. Who makes your firewalls? Your routers? If you don’t know, find out.
• Rethink Zero Trust. If your Zero Trust does not validate every request, you are doing it wrong.
• Stop blindly trusting AI security tools. Use them, but don’t rely on them.

And never forget: You come first—never think you’re safe. Security is a journey not a destination.

Final Thoughts

I have spent decades watching organizations go to the same traps. Believing that they’re too small for the crosshairs. That their security tools will save them. Assuming the latest technology — AI, blockchain, whatever the latest buzz word is — will solve fundamental problems. It never does.

The fundamentals continue to be important: robust authentication, network segmentation, sound architecture. Nail those, and you’re 90% ahead of the competition.

Like Cybersecurity is not only a field, it’s a mentality. And if you’re not questioning everything, you’re behind the curve already.

Time for coffee number four.