My Cybersecurity Journey: From PSTN to Zero Trust and Hardware Hacking

I’m writing this at my desk with my third cup of coffee and thinking about what’s been a career that began for me back in 1993—as a network admin dealing with the nuts and bolts of voice and data over PSTN. Yes, back when your fax machine was your greatest security concern and Cisco routers were behemoths that made today’s firewalls look like toys. And that was just the beginning of my obsession with keeping networks secure. Fast forward almost 30 years and I own my own cybersecurity firm, leading banks and businesses through complex security environments. And most recently, I was at DefCon, still riding the adrenaline high from the hardware hacking village as I saw people stretch the boundaries in ways you’d expect the old-school hackers to be proud of.

Here’s the thing: Cybersecurity isn’t some vague idea. It’s a constant battle against threats that evolve more quickly than any protocol update. Here, then, are some of my personal stories that formed how I think about security today.

From the PSTN Days: Lessons in the Trenches

In the early ’90s, running network infrastructure was knowing every coax cable, every dial-up line, every dumb switch. The risks were clear but low-tech — the main threats were more tangible: a person plugging in the wrong cable or misconfiguring the multiplexers (mux) by mistake. And even then, that ‘low-tech’ environment drove home an important lesson: security isn’t just software, or firewalls. It’s the whole thing, down to the physical connections and who has the keys to the server room.

I remember this one early on … There was a block we were calling on a voice/data circuit and half of the office was down (data-wise). And it turns out, it was a misconfigured mux. It stuck with me, because I learned that little things can spiral out of control. Nothing else in life matters if you’re losing sight of the foundations.

A Burp for the Slammer Worm: A Cautionary Tale of Preparedness

The Slammer worm hit in 2003. I remember that, vividly, because it crashed networks in minutes, like a kind of cyber tsunami. At PJ Networks, we watched the databases of our clients go offline, services crash and a huge spike in customer calls. Even worse, many thought they were immune since, We patched last month. But Slammer took advantage of a hole in SQL Server 2000 — and just one unpatched installation was sufficient.

And OK, a little bit of that is because your corporate patch management practices are fucking laughable. Too many organizations act as though a monthly patch cycle is sufficient — and still, the Slammer worm demonstrated the flimsiness of that assumption. The truth? Security can’t wait until your midnight update windows. It’s a question of vigilance — and it’s something I still hector clients about.

Zero Trust Architecture: So Much More Than Hype, A Real Lifesaver

I recently co-led the redesign of three large banking companies’ zero-trust architectures. If I’m being honest, this project has been a blast and totally draining. You’d think by now financial institutions would have this nailed — but no. Same old humdrum challenges It’s the all gender welcome tradition.

• Overly complex legacy systems
• Ambiguity in Role Based Access Controls
• A culture that resists ‘continuous verification’

Zero trust isn’t a panacea, but when done right, it is game-changing:

• No implicit trust — not even internal systems are assumed to have proven their identity.
• Micro-segmentation for lateral control.
• Precisely crafted least privilege access.

But here’s the kicker. A lot orgs use zero trust as a check box: get a tool, check. Nope. You need to build the trust fabric — people, process, tech — to make it stick. I say to my clients: It’s like adjusting a classic engine (imagine you had that old Toyota Corolla you loved): If any aspect of its performance is out of balance, the car doesn’t run properly.

DefCon’s Hardware Hacking Village: Who Needs the Matrix?

Back from DefCon and the hardware hacking village was excellent. Watching hackers break chips, sniff side-channel signals, and get physical access to devices reminds me: security isn’t just digital. Relying on software tools — the “AI-powered” variety in particular (don’t even get me started on the buzzword bonanza) — or on those alone is dangerous.

The first line, physical hardware security, is often neglected:

• Tamper resistance still matters.
• Side-channel attacks are definitely real.
• Rogue devices can pwn your networks unless stopped.

My takeaway? If your cybersecurity strategy overlooks the physical tier, you’re already playing catch-up.

Takeaway: Real Tips Based on My Own Experience

I know you’re busy. What actually works, if you want to up your cybersecurity without feeling smothered by dialect, is this:

• Patch Early and Patch Often: Don’t wait a month to apply patches. Critical flaws demand immediate action.
• Do Zero Trust Right: More than tools, it’s a mind-set — validate everything, trust nothing.
• Stack Physical and Network; Locks, cameras, machine watching.
• Educate Your Team: The biggest vulnerability and the greatest defense of all is humans.
• Challenge AI-Powered Claims: The thing is that many of these so-called AI security tools do not work as well as advertised. Understand what they really do.
• Audit Legacy Systems: Old tech can serve as a big backdoor.

My Take on Password Policies (You Know I Can’t Let It Go)

Here’s one free rant: You are annoyed by those password policies that require you to change your password every 30 days? Remember when it was complexity that counted — but constant change? Not so much. It trains users to choose weak patterns or write down passwords in a vulnerable location. Better approach:

• Use multi-factor authentication (MFA).
• Allow password managers.
• Prescribe strong, and yet memorable, passphrases.

This stuff works. I have observed it in client networks following repeated intrusions — or even worse, after investing time in scurrying around locked accounts.

Final Thoughts

Cybersecurity, to me, has always been about recognizing that you have to move with the times but never lose sight of where you came from. From the PSTN days hacking on mux configs all the way to the cutting edge of zero trust and hardware hacking, the message remains the same: security isn’t a product; it’s a practice.

Indeed, the threat has changed — threats are more sophisticated — but so too must we be. And sometimes that means taking a critical, questioning stance toward the profusion of new solutions marketed as panaceas. Because remember: Your best defense isn’t in some slick new product or service; it comes from having a solid foundation, conscientious oversight, and a team that understands why security is important (not just how to get it off their compliance checklist).

I’ve been there since before it was digital, and if you are in business — especially in fields like banking or finance — you had better believe there’s something to worry about. And investing in robust network security, well-tuned firewalls, servers that can take a licking and keep on ticking, intelligent routing — that isn’t an IT checklist. It’s business survival.

And if your security strategy still amounts to reaction after the fact or vague AI promises, call me—I’ve got some actual experience to draw upon and a few caffeine-scented opinions that might just change your view of things.