Reflections on Cybersecurity: From Old-School Network Admin to Modern Zero-Trust Architect

It’s so I’m now gazing into my third, which is seriously no-nonsense, much like the security hardware that I insist my clients purchase. Been in this cybersecurity game since the early 2000’s but kicked off all the way in ’93 as a network admin pushing voice and data over PSTN. I can still hear the clang and clatter of backward old multiplexers — the mechanical hearts of our digital communications when I was girl. Those days have deeply influenced my thinking about network resiliency and security—the things I got right and got wrong, the silly mistakes I made along the way and the ones I made that were instructive. But here’s the reality: old tech teaches you more about new threats than you might think.

Consider the Slammer worm episode in 2003. This bad boy spread across networks so fast that most admins were left gasping. We learned up close how brittle traditional perimeter defense could be. Firewalls? Not enough. Endless patching? A never-ending race. I saw entire systems go down in seconds, and it really drove home how quickly a virus can through even the smallest of holes.

Today, I own my own security outfit P J Networks Pvt Ltd. We protect what businesses value – servers, routers, firewalls, you name it. I was recently privileged to work with three leading banks as they raised the bar of their zero-trust architecture. Spoiler alert: zero-trust isn’t just an industry buzzword — it’s the bedrock of today’s security strategy if you want to get ahead and stay there.

And yes, I just got back from DEF CON — that hardware hacking village high is still peaking. God, I love those kind of people. Seeing them take apart and reassemble hardware with a level of creativity which bordered on madness was a reminder that vulnerability is everywhere— even in everything that you consider to be the most foolproof device.

Why My Old-School Roots Matter

Sometimes I reflect on my early career managing telecom infrastructure, and realize that so much of that mindset still holds water. The networks were simple compared with today’s, but each device was significant. You recognized every member in the chain. Forward to today, surrounded by cloud services, zero-day exploits, and claims of AI (and don’t even get me started on “AI-powered” security – more marketing fluff than magic).

It used to be that security meant locking the front door. Now, it’s keeping all of the windows, chimneys, and dog flaps under round-the-clock surveillance. And that’s exactly what the zero-trust model does — trust nobody by default, verify everything, and segment like crazy.

But, here’s something not all consultants tell you:

Zero-trust isn’t plug-and-play
It’s complicated, expensive and requires cultural change
Most intrusions are from the inside or misconfigurations — obstacles even it can’t obscure.

All that being said, if implemented correctly, zero-trust is arguably the closest you can get to a security panacea. I saw it firsthand.

Zero-Trust Upgrades in the Wild at Three Banks

Helping three banks secure their security overhauls has given me a front row seat on what works and what doesn’t. But none were immune, regardless of size and tenure, to the common pitfalls: siloed departments, legacy systems and the occasional ‘but we’ve always done it this way’ mentality.

Here’s a look at how we made the upgrades:

Network Micro-Segmentation. Divide the network into small cells. If an adversary does get in, containment is instantaneous.
Device Hygiene. Old routers and switches, which were vulnerable and forgotten, were replaced or patched with zeal. I can’t stress this enough. And rock-solid hardware is the often-underrated front line.
Multi-Factor Authentication (MFA) Everywhere. Even for internal users. No exceptions.
Continuous Monitoring and Analytics. Applying tools to monitor behavior, not signatures. Suspicious? Investigate immediately.
Strict Access Controls. Just-in-time and just-enough-access policies. The fewer you restrict, the less damage potential.

Challenges? Of course. Pushback from some employees who loathed new login procedures. Integration problems with legacy systems that weren’t friendly. But their outcomes were clear — fewer accidents, better compliance and peace of mind.

Hacking Hardware at DEF CON – The Insurgent Story of a Security Revolution

Just got back and my brain’s still functioning well. When I made it to the hardware hacking village, I received a much-needed reminder that security is not simply zeros and ones. It’s even screws and chips and blink LEDs.

When I watched hackers pry open embedded devices in order to expose covert backdoors, and to sniff out data leaks, I thought about vulnerabilities in corporate security postures. Winning the war on software fronts is for naught if your physical or hardware security is complete crap.

Some personal takeaways:

Never assume your hardware can’t be compromised, just because you “hardened” it.
Physical access is the final admin priv.
Security teams must team up more with hardware folks — the worlds are too often segregated.

Quick Take: What Every Business Can Do Now

I get it, you’re busy, so here’s what you can chew on between meetings:

Assess Your Network Segmentation. And don’t let your infrastructure be an open road.
Audit Legacy Equipment. If your routers or firewalls can drive a car, they’re old enough to upgrade.
Enforce MFA Everywhere. Seriously. No more excuses.
Adopt Zero-Trust Principles Gradually. Don’t panic — take small steps, and take them now.
Regularly Train Your Staff. Humans are your weakest link. Awareness is key.

UPDATE: Another thought it jogged, from The Wire One More Thing About Passwords — My Ongoing Rant

Walk into most any secure government installation and you’ll be asked to show two pieces of identification.

You want the truth? I hate password policies.

Complexity is also just a bad idea: The symbol-this and number-that you can’t remember without writing it down on a Post-it note are closely related to complicated complexity rules in general, and usually with the same extremity. And admins force regular changes, so that everyone is choosing a variant of “Password1!” repeatedly. The result?

Frustrated users.
Increased support calls
Potential security risks

Here’s what I learned: Better security isn’t always about a more-strict password policy. It’s not smarter options like password managers and MFA. But, hey, nobody asked me in much of it.

So if you hate your existing policy, go ahead and tell those guys what you think. You can protect without abusing your users.

Final Thoughts: Cybersecurity is a journey, not a destination

Thinking back over 1993 to the present day, it is clear that cybersecurity changes more quickly than most can chase. My career from PSTN muxes to zero-trust networks has taught me one thing — complacency is your adversary.

Stay curious. Question shiny new buzzwords. Meld the lessons of the past with the tech of the future. And don’t forget: The human factor is still crucial.

If you’re serious about securing out your infrastructure, begin with the rudiments of the old standbys and then dream big. Because those bad guys sure are.

OK, coffee number four coming up. Stay safe out there.

Blog