A few years ago, I walked into a SOC that had been designed by committee. Each team had chosen their own tools. The network team used one NMS. The security team used a different SIEM. The physical security team had their own VMS with its own server. The automation team ran a standalone SOAR platform
I’ll say it plainly: the best firewall in the world, configured perfectly, with the latest firmware and the tightest rules, is exactly as effective as a speed bump if nobody is watching it. A speed bump slows a car down. It doesn’t check if the driver has stolen the car. It doesn’t tell you where
Last year, our team audited 5,732 firewalls. That’s not a round number I picked for effect—that’s the actual count from our deployment and audit logs. FortiGates, Palo Altos, Sophos, Cisco ASAs, a few niche vendors. Enterprise data centres, bank branches, hospital campuses, manufacturing plants, multi-site retail chains. Every single one had at least one misconfiguration.
January 25, 2003. A Saturday. I was at my desk—because in cybersecurity, Saturdays are just Thursdays with better coffee. I’d been in the industry for about a decade at that point, running network operations. We’d seen worms before. Code Red. Nimda. The usual chaos. Nothing—and I mean nothing—prepared us for SQL Slammer. At 05:30 UTC,
