But something about sitting at my desk after that third coffee (which is so strong it might cause my old network admin heart to race) and reflecting on more than two decades of cybersecurity chaos and winning. I began in 1993, when networking meant working with muxes and battling voice and data over PSTN lines. The dark ages, some would say. But you know what? Those days taught me things you simply cannot learn from shiny new tools, or flashy AI-powered mumbo jumbo (yes, I’m that jaded).
We were not just facing threats back then — we were sometimes the threat, without meaning to be. Case in point: the Slammer worm in 2003. I remember it well — our systems were humming and then everything just blew up. For those who weren’t unlucky witnesses, Slammer tore across SQL Server resolution service like a conflagration – it doubled its infected hosts every 8.5 seconds. It brought down networks and delayed emergency services. Fun times.
Fast forward to today. Maintaining my own security company, P J Networks Pvt Ltd, keeps me busy if not out of mischief. Recently, I had the honor of assisting three banks with their move to a zero-trust architecture. Here’s the thing: Zero trust isn’t just a buzzword or a fancy checkbox on your audit. It’s more than just a change in mindset — it’s one my old-school self had to be dragged into, kicking and screaming, from 1994 into 2024.
Why zero trust? This is because perimeter defenses only is like putting a gate on a road with dozens of hidden back alleys. Your network is a city, and if you believe a big-ass firewall will do, all you’re really doing is setting yourself up for a headache.
People ask me all the time what are the biggest differences from when I started and now. Spoiler: Complexity, scale and threat sophistication have exploded. But here are some personal takeaways:
And perhaps most important of all — there are no silver bullets.
Banks aren’t your average enterprises. The stakes are skyscraper-tall. When you’re brought in to zero-trust upgrades for many banks, this is how jumping in feels:
I am frequently reminded of an ancient maxim among mechanics: “You can polish a car but if the engine is only firing on three cylinders, it ain’t going anywhere.” Same for security: finesse your software, policies, alerts … but if your organization’s culture, practices, and software architecture are not fundamentally sound, you’re not genuinely secure.
Just returned from DefCon—and lemme tell ya, the hardware hacking village still makes my tech nerd inside all warm and tingly. But for me watching people reverse engineer everything from car keys to medical devices reinforces how physical security and cybersecurity intersect. It’s a whole new chessboard.
And here’s a banner for those who are thinking about all this as pure cyberisk: hackers can, and will, reach your systems, and not just digitally. When I see a nice smart thermostat or a router with an open debug port — I sigh. Security is not just lines of code, but screws, ports and hardware you can tap into or bypass.
OK, time for a rant — password policies. I get it. No one wants to use complex long passwords that nobody can remember. So companies move to short, quirky and sometimes useless password best practices that can do more harm than good.
Here’s what I’ve learned the hard way:
Bottom line: if you aren’t putting a layer of MFA/2FA between your business and criminals, you’re really just leaving the front door unlocked. Sure do, even a few cases where the password policy is worse than no policy at all, yeah.
Don’t be swayed by AI hype — AI can be supportive, but don’t simply assume that an AI-powered solution will save you.
Running a secure enterprise? I’m no expert, but here’s what I think: Managed NOC, firewalls, routers, servers — these are the linchpins of any defense strategy.
We all love cloud solutions and cool SaaS apps that make us want to outsource everything to someone else, but without a solid managed services foundation, you’re toast.
At P J Networks, we focus on:
All personalized, naturally, because no two experiences are alike. There’s nothing that fits everyone in security — and anyone that’s trying to sell you something one-size-fits-all in security is selling you crap.
Sometimes I think of that first mux — the low hum of its analog processors, the blinking lights — and how far we’ve come. Yet, some things never change. The human element. The unexpected threat vector. The need to keep learning.
And if you, dear reader, come away with one thing from my caffeine-drenched musings — it’s this:
Security is not a destination, it’s a journey Explicit is better than implicit. Tough but rewarding. Risky, screw-up-strewn and sporadically victorious. Suit up, strap in — and press on.
Thanks for bearing with me on this long-winded post. All right, coffee No. 4 here I come.