Building it, and securing it

I started in the oil and gas industry in 1995 and stayed twenty-one years, doing IT, networks and cyber security for global corporations.

I led multi-million dollar projects that spanned the globe, and spent a good deal of those years travelling across America and Europe designing and implementing them. Remote sites where “I’ll call IT in the morning” isn’t an available option. Big budgets, long timescales, and no forgiveness for anything that didn’t work.

I picked up the Microsoft engineering certifications along the way — Microsoft Certified Systems Engineer and Microsoft Certified Professional. Those are the qualifications of that era rather than this one, and I’d not lean on them today. What they left behind is the useful part: I can look at a network and see how it was actually put together, rather than how the diagram says it was.

Two things came out of it that I still use every day. How large organisations genuinely decide what to protect and what to accept — not what the brochures say, what actually happens in the room. And a working knowledge of what enterprise-grade security looks like when somebody is properly paying for it.

Starting it on the side, as an IT company

In 2010 I set up Systems Secure, and I kept the day job.

It was an IT company then. Not what it is now — the ordinary work, done properly, for small businesses around West Sussex.

For six years it was evenings, weekends and holidays. Real clients, real work, but built alongside a career rather than instead of one. I wanted to know it worked before I asked my family to live on it.

That’s not the story a marketing department would write. It’s the true one, and I’d rather you had it, because it’s exactly the advice I’d give you about a decision that size: prove it small before you bet the house on it.

Learning the other side of it

By then I’d spent two decades defending systems. In 2016 I sat the Certified Ethical Hacker exam, which is the opposite discipline — a formal qualification in attacking them. You learn what someone breaking in actually tries, in what order, and how little of it is clever.

What I found wasn’t sophisticated attacks against well-defended companies. It was open doors. Passwords reused across a dozen sites. Ex-employees who still had access. Backups nobody had ever tested. Almost none of it needed a genius to exploit, and almost all of it would have been cheap to fix.

And the businesses standing behind those open doors weren’t the global corporations. They were the small firms I was already looking after in the evenings.

Changing what the company was

That’s the year the two halves of my working life finally met.

By day I was doing serious security for organisations that could afford it. By night I was doing IT for small businesses who couldn’t — and who needed it just as badly, because they face the same attackers with none of the same defences, and far more to lose. A bad enough week doesn’t cost them a quarter’s profit. It costs them the business.

So after twenty-one years I left. The salary, the benefits, the travel, all of it. I went full time on Systems Secure and pointed it at security instead of IT.

That wasn’t a marketing decision. Security was the weakness I could see in nearly every small business I walked into — and ten years later, it still is. Plenty of firms will keep your computers running. Far fewer are watching to see whether somebody has got into them, and the businesses that need that watching most are the least likely to have it.