I came into cybersecurity almost by accident.
Looking back, I think it was a combination of luck, timing, curiosity, and a few unexpected events that slowly pushed me away from software development and into information security.
Please allow me to tell the story in a slightly long-winded way.
I Started as a Programmer
After graduating, my first job was in software development at a company called Ulysses.
I still remember working on bug fixes for source code related to a project called something like KaZa. I may not remember the exact product name anymore, but if my memory is correct, it was connected to a Chinese computer manufacturer that later became associated with the ThinkPad brand.
At the time, I did not think of bug fixing as anything related to cybersecurity.
Today, of course, we know that bugs and security vulnerabilities are often closely connected.
But this was around 2001.
Back then, terms such as “cybersecurity” or even “information security” were nowhere near as common as they are today.
Google still felt relatively new to many people. We searched the web with services such as AltaVista and Yahoo. Yahoo Messenger was one of the main ways people communicated online.
Even inside the office, things were very different.
Sometimes, when employees wanted to invite everyone to lunch, someone would simply send a broadcast message from the Windows command line.
Different times.
It Was Actually a Great Job
The job itself was exciting.
The salary was good, the work was interesting, and our office had a view toward the port.
There were large ships outside, and sometimes I would sit there looking at them and let my mind wander a little.
There was another funny detail about the company.
Several of the managers were very interested in Xiangqi — Chinese chess.
On weekends, they would sometimes come over to my workstation to play.
And I was quite good at it.
During my student years, I had actually won the student Xiangqi championship in the city where I studied, during the first city student sports festival.
Some of my colleagues used to joke that perhaps the managers had hired me not because of my programming skills, but because they wanted someone to play Xiangqi with.
I am still not completely sure they were joking.
Then September 11 Happened
Then something terrible happened.
The September 11 attacks had enormous global consequences, and the effects eventually reached the parent company connected to where I was working.
Our local company was hit badly.
At one point, the company could no longer reliably pay employees.
Nobody really knew what was going to happen.
Then one of my colleagues did something that would change the direction of my career.
He used a network sniffing tool called dsniff to capture email traffic.
Through that, he discovered internal communications suggesting that the company might soon be dissolved.
For me, that moment was fascinating.
Not because the company was in trouble, of course.
What fascinated me was the technology.
I suddenly realized that information moving across a network could be intercepted, analyzed, and used to reveal things that people assumed were private.
That was probably the first time cybersecurity truly caught my attention.
From Programming to Security Curiosity
After that company, I moved to a telecommunications company.
By then, my interest in this new field had grown considerably.
I started researching security topics on my own and eventually began writing technical articles for PC World.
One of my early articles was about TCP Wrappers and the security risks around system access control.
Linux security at the time could be surprisingly fragile.
There were situations where a particular boot or keyboard sequence could allow someone with physical access to bypass the normal login process on older Linux systems.
Compared with modern systems, some of the security controls from that era now seem almost unbelievable.
The more I learned about security, the more interested I became.
And something else was happening at the same time.
My enthusiasm for application programming was slowly disappearing.
I still respected programming.
I had spent years studying algorithms, data structures, and programming languages.
But I began to realize that I was much more excited by a different question:
What happens when systems fail, get attacked, lose data, or behave in ways they were never supposed to?
That question was pulling me toward cybersecurity.
My Second Career Move Took Me Even Closer
When I changed jobs again, I no longer worked as a programmer.
Instead, I moved into system maintenance and technical support.
My job was to troubleshoot problems for customers.
And in those days, perhaps 90% of serious customer incidents seemed to involve computer viruses.
Malware infections could destroy accounting data, damage Windows installations, or make a system almost unusable.
Incident response was much more manual than it is today.
Sometimes the best way to clean an infected machine was literally to remove the hard drive, connect it to a known-clean computer, and scan it from there.
I also became much more involved in data recovery.
One of the major tools at the time was GetDataBack.
For many technicians, it was one of the go-to tools for recovering accidentally deleted or damaged files.
Then there was PCAnywhere, which we used for remote support.
Today, remote administration is completely normal.
At the time, however, being able to remotely connect to a customer system and solve a technical problem felt incredibly powerful.
Every one of these experiences pushed me a little further into the world that we now call cybersecurity.
And little by little, I almost forgot that I had originally trained so heavily in algorithms and software development.
A Lost Laptop Taught Me Another Security Lesson
There was another incident at that company that I still remember.
One important employee was issued a laptop.
At the time, laptops were expensive assets and not nearly as common as they are today.
Unfortunately, the laptop was stolen.
The company's response was interesting.
Instead of first focusing on questions such as:
-
What data was on the laptop?
-
Was the data encrypted?
-
Were there sensitive company documents?
-
Could credentials be exposed?
-
Did we have a backup?
-
What was the incident response procedure?
the main reaction was essentially:
Who is going to pay for the laptop?
The company tried to make the employee financially responsible.
But because the policy had never been clearly defined, the employee simply resigned.
So in the end, the company lost both:
the laptop and the employee.
When I think about that incident today, it is almost a perfect Security+ or SecurityX scenario.
It touches asset management, policy, risk, data protection, incident response, and even human resources.
At the time, however, nobody called it a cybersecurity case.
It was simply a company problem.
I Knew I Wanted Security — I Just Didn't Know What Kind
By this point, one thing had become very clear to me.
I was no longer happy doing traditional technical support.
But I also knew something else:
I really liked information security.
The problem was that I still did not know exactly what I wanted to do inside the field.
Security consulting?
Penetration testing?
Incident response?
Training?
Network security?
Digital forensics?
At that time, the cybersecurity profession was nowhere near as clearly divided into roles as it is today.
I just knew that this was the direction I wanted to follow.
And that was the beginning.
The rest of the journey would take me much deeper into security training, certifications, incident response, penetration testing, and eventually more than two decades of work in the field.
But this post is already getting too long.
So I will stop here.
Part 2 coming soon.
I need to go watch a movie for a while.
Thanks for reading.