Beyond the pandemic: How it shaped organizations and their sec architecture

The talk opens with the speaker, who leads security at a university, looking back over about twenty years of IT change. The traditional model relied on a trusted internal network behind perimeter firewalls, with VPN access as the drawbridge. Cloud services, bring-your-own-device policies and DevOps gradually weakened that boundary, and the pandemic pushed most users and equipment outside it almost overnight. Organizations made fast, imperfect fixes, and the speaker argues that the resulting shortcuts are now coming due.

To show the cost of those shortcuts, the speaker walks through a password manager breach that began with a remote engineer's unpatched home media server. The central argument is that identity, device posture, location and behavior now form the perimeter, and that authorization should be re-evaluated continuously as those signals change. Practical guidance covers classifying assets, threat modeling the most critical ones, and choosing controls by asset tier so they stay manageable. The speaker also advises keeping exceptions to a minimum, using host-based firewalls, and considering cloud-delivered access services or full-tunnel VPN to give remote users a consistent experience.

The closing message is that security controls should be tied to the business mission and to realistic funding. Simpler access paths, such as relaxing prompts for trusted devices, can improve both protection and user adoption. The talk ends with an invitation for questions.