Your Network Isn’t as Secure as You Think (and Here’s Why)

I’m sitting at my desk — third coffee in hand — thinking of all the networks I’ve locked down in my career. And believe me, I have seen everything from misconfigured segmented bank servers to CEOs who still believe password123 is an appropriate password. Security is messy. It always has been.

Back in the 2000s, I’d seen the Slammer Worm burn through poorly secured databases in no time flat. It was the first time I witnessed how quickly unpatched systems can become a company’s worst nightmare. Skip to the present day, and the attackers are quicker still. The threats haven’t slowed; if anything, they’ve adapted.

And yet, in 2023, I still find myself walking into businesses where security teams think they are protected simply because they have a firewall. Spoiler alert: You’re not.

Quick Take: Why You’re Not Actually Secure

Here’s a reality check. If you aren’t doing all of these things, your network is vulnerable:

• Zero-Trust Architecture. If you have not stopped trusting internal traffic by default, you are begging for a breach.
• Segmented Networks. This flat network structure allows attackers to simply move laterally.
• Patching Everything. And that means everything—from the firmware, to the applications, to the router you forgot about.
• MFA (Multi-Factor Authentication) If the system offers MFA, and you’re not using it, that’s negligence.
• Keep conducting security assessments regularly. Therefore stop taking for granted your defenses works and validate them.

The thing is — you can have all the right tools in the world and still be flaky if your implementation is lazy. I’ve watched companies spend money on next-gen firewalls that never got configured properly. Or boast about their endpoint security while leaving unpatched Windows servers.

So let’s get to the bottom of what really protects your systems.

1. Firewalls Are Only Good as Their Rules

And here’s the deal: While firewalls aren’t magic shields. They’re just fancy traffic cops — but only if you set them up right.

Mistakes I See Common Firewall Too Often

• Allowing outward traffic unimpeded. Once malware is in, it can exfiltrate data at will.
• Defaults remain unchanged. All firewall vendors provide base-line configurations but they don’t match your network.
• Forgetting about logging. Without logging, your firewall is effectively operating with a blindfold.

What to Do Instead

• Lock down outbound connections — constrain what services can send traffic out.
• Practice least privilege—open only what is absolutely necessary.
• Watch logs; particularly for strange traffic patterns.

A firewall correctly configured isn’t an option. It’s step one. If you get this right, you should worry less about bells-and-whistles AI-powered security tools (which, by the way, I don’t trust anywhere near as much as solid fundamentals).

2. Zero-Trust: No More Assumptions of Safety for Internal Traffic

Just wrapped up a gig helping three banks upgrade their Zero-Trust Architecture, and if you can imagine the gap between believing you’re secure versus proving it, that divide is night and day.

Zero-Trust Means:

• Everyone is a threat, including your employees (phishing is real).
• All connections are verified – just because you’re inside the perimeter doesn’t mean you get to trust automatically.
• It limits lateral movement — attackers love flat networks. Don’t give them an easy ride.

I’ll never forget going into a company that thought they had excellent internal security and I was able to remote into their internal servers with no password. Simply because the traffic came from within their own network. Absolutely insane.

If you’re NOT implementing some kind of Zero-Trust model then you’re just waiting for an insider threat — or compromised credentials — to do you in.

3. Patch Is Not Optional (But Everybody Ignores It)

I know. Patching is annoying. It breaks things sometimes. But I’ve watched as attackers have taken advantage of vulnerabilities that were years old, against companies, simply because we didn’t have time to patch.

Golden Rules for Patching:

• Automate where you can. No excuses.
• Prioritize Critical Vulnerabilities Not every patch is critical, but some definitely are.
• Don’t forget firmware. Your routers, your switches—hell, even your printers—can be attack vectors.

Slammer worm? WannaCry? They didn’t have to have fancy zero-day exploits; they just needed victims who never patched up.

4. Multi-Factor Authentication: Why It’s Not Up for Negotiation

I still sometimes hear pushback on MFA from executives who don’t want that additional step. Ridiculous.

Also, MFA cuts down on the exposure from compromised credentials by more than 90%! It’s not theory, it’s evidence. Yet I still find:

• Users with email-only MFA (trivially hijacked).
• No MFA whatsoever for VPNs (a hacker’s dream)
• Single-Factor Password Backdoor Admin Accounts (facepalm)

I mean seriously — MFA should be ubiquitous. And if you’re relying on SMS for MFA? Switch to an authenticator app. World SIM-swapping attacks are more common than you would think.

5. Security Is as Good as Your Awareness

No amount of firewalls or EDR you can deploy is going to help if your employees are still clicking phishing emails, which they will.

What works?

• Regular security training — not annual. Regularly.
• Simulated phishing attacks — test people before a real attacker does
• Reporting without fear—if there’s a mistake, employees should not be afraid to report it.

I used to believe that technical solutions would solve all our problems. Reality check: More than 80% of breaches are caused by mistakes by humans. Train your people. Period.

Conclusion: Stop Assuming, Start Testing

I tell this to clients all the time—you don’t know if you’re secure until you’ve proven it.

• Run penetration tests.
• Simulate phishing attacks.
• Audit your network traffic.
• Review configurations on a regular basis.

And for the sake of security, quit believing your organization is too small or not a target. Attackers don’t care who you are, either: if you have data (and every business does), you have something worth stealing.

Back from DefCon and the hardware hacking people in particular should scare the fuck out of you. If we’re that clever on the defensive side, just imagine how much smarter attackers have become.

You have to stay ahead. Because attackers are for damn sure going to.

Buckle Up (Burn These Into Your Brain)

• Firewalls require appropriate rules—otherwise, they are garbage.
• Zero-trust is not a buzzword — it’s how you avoid breaches.
• If you’re not patching everything, you’re vulnerable.
• MFA must be enabled — all cases included.
• So for the examples you provide, security training is a must have, not a nice to have.
• Act as if you’re compromised, and exercise your defenses often.

Now — go verify your firewall rules and patch those updates before it’s too late. You know there’s at least one system you’ve been procrastinating on.