Journey Through Network Security and Zero Trust Architecture

OK — third coffee, clear your schedule — it’s a long one.. Sanjay SETH got entangled in twisted pair of network cables and security challenges since 1993.. Was on-premises network guy, managing backbone of voice and data multiplexing over PSTN – back in the day when dial-up was the height of our tech and firewall usually meant walls painted red. Fast forward, I now own my security consultancy P J Networks Pvt Ltd and assisted three banks to transition to a Zero Trust Architecture. DesemberAfter just having returned from DefCon too, still geeking out over the hardware hacking village (more on that later). Well, here is a slice-of-life writeup from an old timer who has been around the block one more times than he likes to admit being.

Early Days: Network Admins The Magicians of the Art

It was almost a form of sorcery in itself back in the early 90s. Voice and data were to be 1970s-multiplexed cleanly over PSTN lines, hums and crackles on the phone line – that was something you were supposed to know how to fix. The tools? Payphones, the dinosaurs of telephony that you had to punch-buttons into just to get them to work, but boy could we ever make ’em SING.

First, an old war story: The one that really got me was the Slammer worm in 2003 — I still remember it… hurt. The network that was humming along seemed like a cluster fiasco as thousands of SQL servers started yelling at it and choking the infra down harder than rush hour traffic in Mumbai. Slammer was a wonderful wake up call. Slammer—and many worms since—taught us one thing about security: So a threat can evolve very quickly and complacency kills.

You are wrong if you see firewalls and antivirus as enough security mechanisms. Always have been.

Raj Yavatkar, Fellow and Chief Technology Officer, Cloud Native Business Unit

Zero Trust: Not Just a Buzzword

I have recently worked with three bank clients who are scrambling to get zero-trust architecture in place. Zero trust—name a buzzword that has more momentum right now. Yep. But here is my opinion: Zero trust is no silver bullet that you slap on top of your existing mess. In its simplest definition, it requires a sea change in your security mindset.

No more trust but verify. It’s never trust, always verify. And guess what? Old ways of life notoriously stick.

These areas great banks we worked with:

Microsegmentation of networks. Because trust zones are a fossil.
Ongoing, proactive, real-time risk scoring for security access management (not just at authentication time).
Device posture checking for access only to authorized devices.

What I felt truly surprising: it was not little tech issue. They were people and processes. There are legacy mindsets, clinging like rusty old bumpers. Training, communication and leadership buy-in were cornerstone.

DefCon and the HWV (Hardware Hacking Village)

I had just returned from DefCon, and all I can say is wow — the hardware hacking village was amazing! USB devices, IoT stuff, routers—anything with the same type of vulnerabilities as these ought to make you think more about hardware side of security with embedded devices. Who remembers 2004 when fw=perimiter! Whatever it is attached to network now the whole thing connected to network being a perimeter itself

Some highlights from there:

USB Rubber Ducky style attacks converting a keyboard to a weapon
Legacy radio frequency hacks (who does this?)
And if anything, a few “AI-powered” declarations probably felt somewhat overhyped; go ahead and root around and you’ll discover that half of those smart gadgets were an open book.

Correct: I am dubious when marketing meets “AI-driven security. It’s often smoke and mirrors.

Password Policies, And a Rant(ier) Than You’ve Seen Before…

This is where I get a little controversial. Password policies. Don’t get me started. The endless complexity, needless rotations and arbitrary expiration times?

Bad idea. Here’s why:

Complex, forced changes are an easy way to get users writing down their password or reusing them.
Frustration and bad habits are produced with frequent expiry
MFA better investmentоще- Multi-factor authentication (MFA) is a better investment.

Buy MFA and some education instead of 25 character gibberish that nobody wants to, or can remember. Yes, education. After all, you can have the finest security stack available but if your users get phished or social-engineered it is of little use.

Lessons From My Own Mistakes

And over the past 30 years, I’ve made plenty of mistakes. I was as guilty of this as anyone early on assuming perimeter security would do it. Big mistake. Because time was passing since my firsts battles, networks changed and so did the attackers while I needed to get smarter or i would be burned.

There is another one: do not underestimate the value of backups and incident response plans. Slammer showed me—and many others—that panic is your frenemy. An unknown plane has never been better than having a tested plan.

I am not stating that I have figured it out. Far from it. Experience however humbles and keeps us watch. That’s key for any business.

Quick Take: Where to Start with Your Business Right Now

Zero trust isn’t optional. Begin the process now, do not wait until you are compelled.
MFA is your friend. Do it everywhere possible.
Physical security of devices. That includes not just servers but networked gear.
User education. It’s a continuous investment.
Incident response plan. Test it, update it regularly.

These are your baseline. Anything less and you are asking for problems.

Closing Thoughts: More than Anything Else, Cybersecurity is Just Like Maintaining a Classic Car

With that, here’s my analogy for the day — your network is like an old car. It is not like you park it in the garage and hope for the better. You top off fluids, wrench in your bolts, and switch out old parts for new. Same thing with security.

Sure, every now and then you gotta quiz it to see what it can do. Difference is, if your car breaks down you phone a mechanic. So, Your Networking Breaks Down you lose millions and reputation..

It is understandable why security is not just a one-time activity like the move from physical world to digital space brought back new ways to ruin other people’s lives. It is a never ending process, its a lifestyle.

And hey, if you would like to talk about a firewall upgrade, server changes, configuring your router or simply exchange some crazy ass DefCon stories, shoot me over an email at P J Networks.

Stay sharp (and keep those digital engines purring) until next coffee break.

Blog