Cybersecurity Evolution: From Network Admin to Zero Trust Leader

It’s something I realized while sitting here at my desk the other day, third cup of coffee in and still riding that early morning caffeine high: cybersecurity has really changed a lot since I got my start as a network administrator in 1993. If I’m being honest, there are moments when it feels as though I’ve lived many lifetimes within this insane world of bits and firewalls. From battles with the ancient — old PSTN mux for voice and data, an old shared antiquated minicomputer in a closet for e-mail, fighting off the infamous Slammer worm, to now leading zero trust upgrades for banks(this country’s backbone) it has been quite an adventure. And yeah — I collected some strong opinions along the way. So if you’re short on time, fast-forward to the Quick Take below. But if you want to learn a few stories and take real-world advice from someone who’s been there, in the mud — have a seat.

Getting Began: The Times of PSTN and Community Admin Life

Networks were a very different animal back in ’93. No fancy cloud, no virtualization. Nothing but some hardware — switches, routers and those traditional multiplexers ferrying voice and data over the PSTN. If you were the network admin, you were a plumber in a silk cape. You ensured the pipes did not leak and the packets flowed. Looking back, that experience was priceless — because it taught me the importance of stability in security. If your network can’t even deliver data consistently, no firewall or anti-virus program will be able to.

But the one that really caught my attention was the Slammer worm in 2003. That little bastard took systems offline everywhere — so quickly it virtually flew right past the perimeter defenses of a bazillion organizations. I recall system after system I was patching, with my hands trembling, an adrenaline rush. Slammer was an enormous wake-up call on the necessity of patch management. And by the way — many a company still consider patches something they’ll do, someday. I can’t emphasize this enough: patching is mandatory. Ever.

Network Admin to Security Business Owner

Fast forward. I now own P J Networks Pvt Ltd, a security organisation focussed on cutting edge cybersecurity (yes, firewalls, servers and routers are still a way of life). The weirdest part? As soon as we think we’ve seen it all, the threat landscape changes — and so must we.

We recently assisted three banks in completely redesigning their zero-trust architecture. Financial firms are the ideal test case, since their stakes are highest. Zero-trust is not just security jargon or a buzzword. It’s essential when you’re fighting advanced persistent threats and zero-day attacks. The old castle-and-moat model of security? Dead. And if you haven’t flipped the mindset to assume that every user and device is hostile until proven otherwise, your mental defenses are already breached.

Zero-Trust Security Essentials

• It involves meticulous asset inventory and segmentation. You can’t defend what you can’t see.
• MFA is simply not optional. If you’re not using MFA, stop reading this and go turn it on now.
• Real time monitoring and behaviour analysis for anomalies

And while tech is important, the human touch should not be dismissed. People — employees in particular — can either be your greatest weakness, or your primary defense.

DefCon 2024 Buzz Hardware Hacking Village

Just returned from DefCon, and man—the hardware hacking village continues to impress me. It’s a bit like walking into a candy store if you’re a security nerd. Watching people reverse-engineer chips, circumvent hardware locks and repurpose old routers is the reminder that physical security and hardware vulnerabilities deserve a lot more attention.

IMO too many companies put all their focus on s/ware p/ches and network f/walls, while leaving hardware some times quite literally like the front door wide open. Even your trusty router or firewall box, if compromised at the firmware or hardware level, is a ghost running in your system.

It’s why the attacks of the latest generation are often hybrid: a combination of software exploits and hardware tampering. Which brings me to a pet peeve:

The Siren Call of AI-Driven Security—and a Bad Idea for Police

But here is the thing —I understand why there is hype surrounding AI security solutions. But I’m skeptical. Many of our so-called AI products are actually just fancy heuristic models wrapped in a block of buzzwords. They often generate so-called false positives, marking benign events as a threat, and they tend to miss cleverly camouflaged attacks. AI isn’t magic. It requires good data, as well as human oversight.

Don’t jump on solutions that wield AI in the name without testing them. Assess their effectiveness, integrations, your current security posture — and your team’s abilities to manage them.

Let’s Talk Passwords—Yes, AGAIN

Now, for the ramp… (scroll down) a bit of a rant (warning) comes behind it. Password policies drive me nuts! Most organizations have policies that mean passwords are either impossible to remember or so simple that people just write them down. Both are terrible.

This is what I say to my clients:

• Banish complexity for complexity’s sake. Length beats complexity any day. Aim for passphrases.
• Push password managers — yes, I get it that some of you freak on the idea of storing secrets in a vault, but really, it’s the only sane way in 2024.
• End forced password changes unless there’s evidence of compromise. Periodic password changes every 30 or 60 days create predictable patterns, while also promoting user frustration.

In all cybersecurity, nothing is as annoying as watching good policy get wrecked because it conflicts with human nature.

Old Tech Still Matters

I’m a sucker for analogies (and a bit of nostalgia), so consider your network, for example, to be like a vintage car. You don’t just toss any upgrade into the car willy-nilly without understanding how it works — you maintain, tweak and upgrade pieces with consideration. If the firewall is old, it’s like driving a 1960s muscle car with bald tyres down a mountain road. Fast way to crash.

Yet, in a world in pursuit of cloud and AI, servers and routers and firewalls are still the backbone. You can’t ignore those parts because they’re old tech any more than you can ignore the chassis because what you really want is shiny rims. When you ignore the fundamentals, they’re going to bite you.

Quick Take: Here’s What to Know

• Patch management from Trustwave: patch fast, patch often
• Zero-trust isn’t optional. Segment, verify, monitor.
• Putting hardware security on back burner. And don’t forget about your routers, firewalls and physical devices.
• Be suspicious of AI-powered tools; they are not a cure-all.
• Password policies? Make them human-friendly. Passphrases + password managers > complexity gymnastics.

Do not forget the basics — servers, routers and firewalls are your bedrock.

Wrapping Up

So yeah — three decades later, I’m still learning. (Sometimes) still stumbling over my own mistakes (seriously, please don’t ask about that time I locked down an entire client network during a patch). And still enthusiastically helping businesses protect themselves in this ever-changing world.

My biggest piece of advice? Security is not a checkbox exercise, it’s a mindset. And for all of the technological evolution, the human vigilance and the common sense will remain your strongest allies.

Now … where is that fourth cup of coffee?