From PSTN to Zero-Trust: Lessons Learned in Cybersecurity

And here I sit, at my desk — third coffee in, fingers crossed I don’t spill it on my keyboard — thinking about how it all began. 1993. The fresh-faced network admin fiddling voice and data mux going over PSTN lines that were barely better than tin cans on a string and clueless about what a worm even was, less yet the raging Slammer worm that took down so many a decade later. A quarter century or so later I’m running P J Networks, separating the bank wheat from the cybersecurity hype chaff and just got back from DefCon’s Hardware Hacking Village (I’m still glowing). Allow me to provide you some with some real-deal lessons learned from all these years – we’re not exactly reminded to be the most politically correct cybersecurity consultants out there, and fair warning!

The Early Years: Building Network Admin Fundamentals

When I got into it, they didn’t even have the word cybersecurity — all they wanted was network stability. The days of dealing with mux hardware, configuring routers and servers by hand, and the sound of analog phones ringing (literally) taught me two key things:

• Your best friend now is repetition. You can will want a fallback route or even two because the PSTN lines aren’t all those things, reliable.
• Basic Is Best for Security. If your hardware and routing doesn’t isolate your network to just what it needs to get the job done, then forget about adding fancy software firewalls.

But here’s the catch: The big threat then was human error, not malware or state-sponsored hacking. And I have made my mistakes. There was that time I misconfigured a routing table and took down voice traffic for an entire office. Felt like shit, but you quickly learn precision pays off.

The Slammer Worm: A Cyberquake

Slammer was a wake up call like no other. Remember it? Introduced in 2003, it spread so quickly it actually clogged ATM networks and brought down hospital systems. Seeing that storm come through in real time was like watching a wildfire race across dry land, except your data, and the trust of potential users, were on fire.

From Slammer, I learned:

• Patch early, patch often. But patches are only effective if you use them.
• You can’t live and die by the 3-pointer. That worm sliced through traditional firewalls like butter.
• If you don’t have incident response plans that are ready and tested, you’re fumbling in the dark.

Turning the Page: Admin to Cybersecurity Consultant

Today, P J Networks concentrates on protecting contemporary enterprises, particularly those in the financial sector. Lately, I’ve assisted three banks in the advancement of their zero-trust architectures. Want to know the dirty truth? Zero-trust isn’t a magical box you check off or something you purchase. It’s a way of thinking about things — and that’s a hard thing for any sort of organization to swallow.

I tell clients:

• Never suffer, always scepticize isn’t a phrase, it’s your new OS.
• Segment and least privilege access are your friend!
• Identity is the new perimeter–so spend lots on strong authenticated methods.

But — and here it is critical — zero-trust still needs to run on absolutely top-notch hardware. Firewalls, next-generation routers, and secure servers are the backbone. Software alone isn’t enough.

The Physical Security Experience (Hardware Hacking Village) – Because Physical Matters!

I just came back from DefCon, the Hardware Hacking Village. Man, if you think cybersecurity is only a matter of bits and bytes … Well, you’re missing the big picture. Seeing hackers gut IoT devices, mod routers, and then suck out secrets — it’s humbling. Hardware flaws are the weak link we keep ignoring.

Some takeaways:

• You might be running the best firewall software available, but if your router firmware is unsecure, you are also exposed.
• Physical access is still game over. Inside threats aren’t just a punch line.
• Supply chain risk is real — know where your devices are coming from.

My Two Cents on Password Policies (And Why I’m So Pissed Off)

Here’s my notorious rant time. Password policies? Sometimes they’re a mess. I know, I know — difficult passwords, rotations, expiry dates. But:

• Requiring users to change passwords every 30 days? Please. It frequently forces them into cliche routines…
• Complexity requirements make people write passwords down on sticky notes or use Password1! variants.
• MFA, multi-factor authentication, that’s the game changer. Focus there.

But hearken: the cooking analogy sums it all up nicely, because you can have the most amazing line-up of ingredients (we’re talking about passwords here, obviously) but if your recipe (i.e., your policy) is too complex, ain’t nobody gonna follow it — and then your cookies are burnt.

Quick Take: What Businesses Need to Know Now

• Hardware is still important — invest in quality firewalls and secure routers
• Embrace zero-trust, but package it as cultural shift, not a switch
• You should patch, especially firmware and network devices
• Insider threats are real: Also inside threats, not just in the classic sense of someone using an employee’s workstation after-hours, but also more visibly when it comes to things like disciplines where people are involved, and indeed physical security.
• Upgrade authentication—(Because multi-factor beats complex passwords every day!)
• You have to train your staff. Humans = weakest link

Looking Back and Moving Forward

Sometimes I get a little nostalgic for those old PSTN days — installs where cables were lovingly stapled, manuals thicker than your arm, and a simpler threat model. But here’s the rub: Cybersecurity has matured and it’s dirty and messy and complicated now and if you’re not chasing the bleeding edge (translation: not simply some AI-powered buzzword) you’re already behind.

Now, I have my biases — I am suspicious of this AI-will-do-everything trend. Don’t get me wrong, AI can help, but if all of your security posture is relying on a black-box AI engine with no human in the loop? You’re gambling.

Because when it comes down to it, cybersecurity is not magic. It’s about people, processes and yes, the right tech — network managers who grok their hardware, IT folks who uphold discipline, and executives who get it.

So that’s it: my experiences, my rants, my hope for a less precarious digital future. Get another coffee and begin to see your network the way I do — holistic, paranoid, hopeful.

And if you ever want to catch up from our industry’s old-school PSTN days, have a chat about anything zero-trust, firewalls, etc.—please reach out.