Lessons on Cybersecurity from 30 Years in the Trenches

I promise you, with each and every damn attack I hear people gasp about, I say to myself ‘okay now I have seen it all.’ I just got back from DefCon, and my head is still spinning from what I saw in the hardware hacking village—let’s just say some of the security innovations out there are downright laughable. But that’s not the subject of today’s rant (or lesson, if you prefer).

The Real World of Cybersecurity

Today, we’re discussing how all of this plays out in the real world: the attacks, the failures, the thing that keeps you up at night. I have been doing this since when we were multiplexing voice and data over PSTN and firewalls were just starting to be a thing. And trust me when I say that a lot has changed but some mistakes just never get old.

Quick Take: What You Will Be Ready To Take Away From This Write-Up

Takeaways from fieldwork — theory doesn’t work without practice.
Most common security failures I’ve seen (even banks, yeah, I said it).
How Zero Trust isn’t simply a buzzword—it’s survival.
Why most AI in security is hype (and sometimes hazardous).
The one stupid *security* mistake that people are STILL doing after all these years!

It is now 2023: Firewalls Are Optional, Security Is… Hope

As a network admin starting out in 1993, security was largely an add-on. You were going to establish a PSTN “call” (dial-tone) connection, create some network rules (including inbound/outbound dialing rules), and if things went wrong — then, well, you crossed your fingers you had a backup somewhere. Firewalls weren’t yet de rigueur, multi-factor authentication didn’t exist, and password policies? A joke. (Don’t laugh — half your users are still on Password123 to this day.)

And then came the worms. Slammer in 2003 — now that was an alarm call. I watched entire corporate networks emaciate in minutes, quickly infecting unpatched systems. Watching that disaster unfold taught me one lesson:

Security is never just an IT problem; it’s a business living thing.

That’s what companies still don’t understand. Executives like to talk cybersecurity, but don’t want to spend on it. They don’t listen to policies for patching until their entire infrastructure is gone. And when things go down? All of a sudden, the IT team is to blame.

The Exact Security Errors … 30 Years Later

After all these years, you’d imagine we would do better learned from earlier breaches. But alas—businesses continue to make the same stupid mistakes that made Slammer effective 20+ years ago. Stuff like:

Leaving systems unpatched.
Needing more perimeter defenses (believing the firewall is sufficient)
No proper access control — employees have admin login simply to have it.
No segmentation on networks.
Thinking that AI-enabled security will fix everything.

It’s a fact — attackers are not innovating as much as people believe. They don’t need to. And then we just keep leaving the same doors wide open.

The Why of Zero Trust: It Isn’t Just a Concept, It’s Survival

I recently assisted three banks with their Zero Trust security posture. And I’ll tell you why — banks have as bad security practices as anybody else with their security budgets. (And worse, as they believe they’re secure.)

Zero Trust is not some enriched hardware — it is a shift of mentality. It means:

You never trust a device/user by default.
The access is granted post on-time verification.
Network segmentation so attacks cannot move laterally.
Continuous monitoring — threats don’t stop at 5 PM.

If you allow corporate data to rest on a flat network, that any rogue user or exposed machine can wander through—congratulations. Essentially, you’ve created a burglar’s dream.

The AI Security Hype (And Why I’m Not Fully Buying It)

Look, I get it. AI is the latest and greatest buzzword. Most security vendors claim to have an AI-based solution that can anticipate and prevent threats before they happen! But let’s be real.

AI tools are only as good as what they’re trained on.
Adversaries understand how to bypass AI detections.
Automated security systems are a nightmare of false positives.
If AI mistakes traffic and inhibits normal activity? All of a sudden, half your company can’t sign in.

Would I apply AI as a force multiplier for detection? Sure. But would I blindly trust it to protect an organization? Hell no. AI, at the end of the day can tell you there’s a threat, but a person still has to validate or respond correctly.

If someone tells you AI can solve your security problems all by itself, they are either lying to you or trying to sell you something.

Passwords: To Password, or Not to Password?

Alright, rant time. Because if I hear from one more company that their security strategy is based on “strong passwords” — I’m going to lose it. And here’s the reality check: Nobody remembers complex passwords unless they are reused. That’s just human nature. Your 10-character restriction is not helping security—it is decreasing it, because users will write them somewhere.

Better approach:

Use password managers—they fix 80% of all passwords security failures.
Enable multi-factor authentication (MFA)—by 2024, you need to stop acting as if the password is enough.
Passkeys and biometrics — in fact, the future is heading in the direction of no-password security, and for good reason.

If passwords remain your employees’ frontline of defense, you’ve already been compromised.

Conclusion: What Worries Me: Final Thoughts

I’ve worked in cybersecurity for the past three decades. I have witnessed viruses cripple networks in minutes, social engineering scams empty bank accounts, and businesses losing everything because they were sure it would never happen to them. But what really gives me sleepless nights?

The delusion that basic security is sufficient.
Executives treating security as an expense rather than an investment.
Not testing your own security—if you’re not doing regular security audits, you’re asking for it.
Believing that we’re too small to get hacked. (Newsflash: You are more hackable than a hard-guessed Fortune 500.)

I have a strong suspicion that most breaches don’t occur because the attackers are smart but because we are lazy. And in cybersecurity? Laziness is expensive.

Final Takeaways

If you don’t have a Zero Trust model, start immediately.
Patch your damn systems.
Give up on the idea that A.I. will somehow save you.
Enforce MFA—without exceptions.
Perform security tests BEFORE the hackers do it for ya.

Cybersecurity isn’t magic. It’s about discipline, investment and vigilance. And if you don’t treat it seriously? Someone else — definitely with bad intentions — will.

Blog