Is Your Cybersecurity Strategy Failing? Here’s How to Fix It

I’m writing this after my third coffee of the morning, and I’ll have you know I’m still decomposing from the high that was DefCon. Hardware hacking village was amazing this year and honestly it made me remember why I got into cybersecurity in the first place. There’s something gritty and authentic about learning how things break so you can reinforce them.

But here’s the thing. Most businesses? They aren’t thinking like hackers. They’re stacking layers of security onto legacy, bolted-together networks and hoping their “AI-powered” security tool will save the day. Spoiler: it won’t.

I’ve been doing this since the early ’90s—started out as a network admin back when we were wrangling muxes to carry voice and data over PSTN. I experienced the Slammer worm, and saw entire businesses go dark because they missed a patch. And now? I own my own cybersecurity firm, advising companies (three different banks, just last month) on how to improve their zero-trust architecture. I’ve seen what succeeds… and what always goes wrong.

Let’s discuss missteps I’m still seeing — and what’s needed to avoid becoming your own breach headline.

Quick Take: Security Errors You’re Likely Making

If you don’t have time to read the whole tirade (but you should — there’s coffee-fueled gold to be had): Here’s the Chekhov-ian summary:

• “We have AI security, we’re fine. No, you’re not. AI is one of many blades in an arsenal, not a sorcerous shield from damage.
• Your password policies suck. If you are still forcing users to change their password every 60 days and permitting “Summer2024!” —stop.
• Everything’s too open. Least privilege access is not a recommendation, it’s survival.
• You’re not testing enough. If you’re not phishing your own people, someone else is.
• Zero trust is a philosophy, not a product. You don’t “buy” security. You have to build it.

Now, let’s dive in.

1. Stop Believing the Hype: AI Won’t Save You

I’m going to get myself in some trouble here, but I don’t care: Most so-called “AI-powered” security solutions are fancy marketing for automated, glorified assembly lines. Machine learning is helpful, sure — but if you’re depending on A.I. to obviate basic cybersecurity hygiene, you’re asking for trouble. Security needs human beings who really get security. AI can assist (when appropriately trained), however all said and done:

• Your AI will not save you if your firewall config is bad.
• AI won’t protect your users against phishing emails.
• If you don’t patch vulnerabilities, AI will not seal them.

Stop chasing shiny new tech, and focus on your fundamentals first.

2. Your Password Policy Is Almost Certainly Garbage

Password policies, ah, one of the top 10 rants of my life. I’ve witnessed companies impose the worst policies you can imagine:

• Requiring users to change their passwords every 60 days.
• Letting dumb-as-rocks passwords like `Winter2024!`.
• Disallowing the use of password managers (why on earth?

Is this news? Users hate passwords. If you make them jump through your little unreasonable hoops, then they get lazy — they write them down on sticky notes or use one password everywhere. The solution?

• Let them use passphrases. If you can, something like `PurpleBanana$CoffeeMug` is much better than `P@ssw0rd!`.
• Enable MFA. I mean it, to the good, it really lessens account compromise risk.
• Involve frequent change at your will. If there’s no breach, allow them to keep a strong password.

If your security is still based on passwords alone in 2024, you are already behind the curve.

3. Your Network Is Overexposed—Sequester It

I see the same problem every time I audit a company: too many people have too much access. This isn’t simply an annoyance — it’s a huge security threat.

A couple months ago, I assisted a bank in rewriting their zero-trust strategy. Their issue? Employees had access to systems they didn’t need. An entry-level hire might (intentionally or inadvertently) be exposed to customer data. That’s insane.

Reality check — if an attacker compromises a set of credentials, how far can they go? If the response is “way too far,” you have to correct this ASAP:

• Enforce least privilege. Access should be limited as much as possible.
• Use network segmentation. An HR staff member doesnt need ANY access path to the payment processor server.
• Regularly audit super user access. Employees change roles. Access should evolve along with them.

In zero trust, everything and everyone are untrusted by default. Start acting like it.

4. You’re Not Testing Enough (And It’s Dangerous)

I don’t know how many times I’ve seen companies think they have good security, until we do a simple phishing test, and half of their employees click the malicious link.

Here’s the problem: Most companies are not testing enough of their people. They hold a yearly cybersecurity awareness seminar (which half the staff ignore) and consider the job done. It’s not.

You require periodic, real-world feedback:

• Phishing simulations. Training employees to identify real attacks.
• Red team exercises. Allow a crew to attempt a breach.
• Incident response drills. Because when a breach does occur, reaction time counts.

Security operates like muscle memory: Without regular training, you won’t perform well in an actual attack.

5. Zero Trust Is Not a Product (So Stop Getting Mad at Zero Trust)

This one gets my blood pressure up. Every week, I get marketing material about some Zero Trust product and I want to throw my coffee at the screen.

Zero Trust is not a one-product product — it’s a philosophy. It’s an assumption about security that everyone and everything is an enemy combatant until proven otherwise.

Just last month, we assisted a bank in implementing the zero trust. They kept saying, What product do we buy? My answer? “None, because you don’t buy security, you build it.”

Building zero trust means:

• Verification of every access attempt. No implicit trust, ever.
• Least privilege everything. If a person doesn’t need access, they are not granted it.
• Continuous authentication. Being logged in once doesn’t equal safety.

If anyone tries to sell you a single “Zero Trust” solution — run.

Final Thoughts

I understand it — cybersecurity is rather daunting. But it’s also non-negotiable if you want your business to stay afloat. Attackers are getting smarter, tools are evolving and the threats are changing every day. You have to evolve with them.

If you remember nothing else from this:

• AI is not the silver bullet — start with the fundamentals.
• Good passwords + MFA > constantly-changed weak passwords.
• Limit accessibility — too many permissions on employees are a hacker’s paradise.
• Test your security often. Your defenses should be as adaptive as the attacks.
• Zero Trust is not a tool, it is a strategy. Embrace it.

I’ve spent three decades watching businesses repeat the same mistakes over and over again. Don’t be next.

Now, I need another coffee. Stay secure.