From Network Admin to Security Consultant: Real Lessons in Cybersecurity

I’m sitting at my desk on an early morning, third cup of coffee in hand, the buzz from the hardware hacking village at DefCon still ringing in my ears. After over 20 years in cybersecurity —I kicked off in 1993 as a lowly lowly network admin wrangling those multiplexers for voice and data across the PSTN — I have been there and done that. The good, the bad and the outright head-scratching. And here’s the thing: real life experience is the best teacher when it comes to learning what really protects your business.

Network Admin to Security Consultant: A History Lesson

I recall it as if it were yesterday, the day the Slammer worm was born. It was 2003, and I was in the trenches managing traffic over fragile network links. Slammer was that driver who not only crashes into every car in sight, but then proceeds to barrel through the busy intersection afterward—unaware of the mess being made. That worm didn’t discriminate. It revealed every frailty in the architecture of networks at the time. And guess what? A few of those errors persisted because we were slow to learn.

Fast forward to the present – I’m the proprietor PJ Networks Pvt Ltd,we are the Leaders in the Arena of Security Services. My team and I were recently called in to assist three banks redesign their zero-trust architectures. What a mindset shift that would be. From the presumption of trust to have into perimeter to the presumption of trust nothing by default. But I’ve got news for you — this zero-trust thing is not just marketing speak. It’s the ironclad seatbelt you’ve got to click on before hitting the road of modern cybersecurity.

The Realities of Zero-Trust Architecture

I’ve witnessed it — banks choking as they learn to embrace zero-trust. Why? Because it rocks their staid way of thinking, forcing them to reassess every asset, every user, every connection. But here’s the litmus test:

Zero-trust isn’t only about fancy tech layers.
It’s a cultural shift.
You have to design it around least privilege — In other words, give users and devices the minimum amount of permissions they need, just enough to do what they need to do.

Here are a few actionable takeaways we learned from the upgrades we’ve done:

Microsegmentation rules — but not too much. Dividing everything into tiny slices may sound secure but cranks complexity into overdrive.
Continuous authentication: Sessions should not be “set and forget.” Re-authenticate and check consistently.
Keep logs and audit them relentlessly — log files are your forensic gold mine.

DefCon and the Hardware Hacking Village: Why It’s Still Relevant

The hardware hacking village at DefCon was a revelation, folks. When you watch people pick apart holes in otherwise everyday hardware, routers, firewalls, hell, even the IoT, you realize that your battlefield isn’t always in your firewall rules or your encryption protocols. It’s real world. Stuff you plug in and blow air over. Consider it old-school car mechanics coming to understand that modern cars are essentially computers with wheels. You have to know everything, the userland and the plugin API and the firmware under the hood and every last bolt.

I witnessed first hand what misconfigured firmware on routers can do when it silently leaks your entire network to an attacker. And here’s my usual rant: Why do so many vendors send products. to market with security as an afterthought? It’s as if you handed someone a car with no brakes and then said, Just be safe.

Quick note: You know I’m reflexively skeptical of anything that boasts of being AI-powered security. AI is great, yes—but when your AI can’t explain itself, requires a black box, how do you trust it to protect your assets? You know — having a cook you never meet or speak to, but you want that person to prepare your family meal. Risky at best.

Password Policies: The Elephant in the Room

Alright, I’ve said this previously, but it is worth repeating. The password policies of many organizations are rooted in the past. Security is not long, nonsensical passwords full of complexity that a user writes on a sticky note hidden under the keyboard. They’re security theater.

Promote passphrases over passwords — something that you can remember that’s long.
Whenever possible, employ multi-factor authentication (MFA).
End the recurring password changes every 30 days. And that is a false sense of security.

Your users aren’t crypto geeks. They just want to work their job.

Real-World Lessons from the Field

Experience is the best teacher, nothing can compare to when we have been through it. Here are a few new engagements that I can think of:

The Bank That Ignored Legacy Devices: Pushing zero-trust but leaving several old routers running with outdated firmware dominates the front-page stories. Result? The data breach came from attakced vulnerabilities. Lesson: Legacy is not only history; it’s a liability.
The SMB That Trusted One Firewall: Small-business owners frequently believe that they’re off the hook if they’re running just one firewall. But modern threats are furtive — there is no silver bullet. They require defenses in depth and persistent monitoring.
The Corporate Office That Lost Track Of Endpoint Security: One company got its network right but forgot about endpoint. One vulnerable laptop provided attackers with an entry point. What’s more, your chain is only as strong as your weakest link.

My Take on Security Future Proofing

Tech changes fast. What was yesterday may be nothing tomorrow. So what’s the answer? Here’s what I say to my clients:

Invest in people, not just the technology. Skilled teams can identify and respond far, far, far faster than any tool.
Continuous education and awareness. Hackers evolve, so should your staff.
Avoid overdependence on a single solution or vendor. Defense in diversity is your friend.

And finally:

Trust but verify is so last century — trust nothing without verification.

Quick Take: My Cybersecurity Tips for the Desk

Zero-trust is mandatory. Set up least privilege access.
Patch everything—fast. Delay equals risk.
Password strength is not king; MFA is. Better user experience, better security.
Layer up defenses. Firewalls, servers, routers—all must collaborate.
Legacy equipment = risk. Upgrade your plans before the hammer falls.
Remain skeptical of AI-powered claims. Know what’s going on under the hood.

Wrapping It Up

Running P J Networks Pvt Ltd has been a rollercoaster ride– from controlling the muxes over pstn lines in the early 90s, to assisting banks to build secure modern zero-trust networks. Steer your course along the way, the essentials are unchanged: know your network, your perimeter (or lack of one) and like always expect the unexpected.

Security isn’t glamorous. It’s not a set-it-and-forget-it deal. You must remain vigilant, be willing to shift (sometimes literally, like last week when I was sniffing traffic at a client-site), and get your hands dirty as necessary.

So here it is from someone who’s spent longer in the trenches than most of the tools have existed. Think of your security posture as a classic car: You keep the engine tuned up, make sure every bolt is tightened, and yes, you upgrade the parts on occasion. But it’s in the drive at the wheel now, knowing you’re ready for whatever may come.

Alright—time for coffee number four. Stay safe out there.

– Sanjay Seth, P J Networks Pvt Ltd

Blog