By Nnamdi Ojiego

As businesses increasingly rely on digital platforms, the demand for advanced network security grows stronger. In this interview, Michael Nwokolo, a cybersecurity expert with over a decade of experience in securing multi-cloud systems and implementing Zero Trust architectures, and who  works with Weco Systems International Ltd as the Manager Deployment, Operations and Support, shares how he’s helping organizations redefine and secure their digital environments in the modern world. Excerpts:

With about a decade of experience in cybersecurity, what would you say has been the most significant evolution in network security?

The biggest shift has been moving from traditional perimeter-based security to adopting more layered, dynamic approaches like Zero Trust. When I first started, the focus was on securing the network perimeter, but with the rise of cloud environments and remote work, that perimeter is almost non-existent now. Today, we assume that threats can come from anywhere, so we focus on securing every access point, constantly verifying identities, and limiting access to only what’s necessary.

How do you approach the challenges of securing multi-cloud environments, and what do you see as the most pressing threats today?

Securing multi-cloud environments requires creating a cohesive strategy across all platforms while recognizing their individual nuances. It’s about maintaining consistency in security policies but also leveraging the strengths of each cloud service—whether it’s AWS, Azure, or Google Cloud. The most pressing threats today are ransomware attacks and advanced persistent threats (APTs). Both are becoming more sophisticated, often exploiting cloud vulnerabilities or gaps in access controls, which is why continuous monitoring and updating are critical.

Who are those behind these threats/attacks like ransomware and APTs?

Ransomware and Advanced Persistent Threats known as APTs for short, are typically carried out by different threat actors with different motivations and skill level. You have the insider threat actor who is motivated by revenge, Nation-State actors who are motivated by sabotage, or political objectives and we also have Hacktivists driven by ideological motives. One thing that is common across all the threat actorsis their potential to cause damage irrespective of skill level and motives. Each of these threat actors exploit vulnerabilities ranging from misconfigurations to poor access controls, to achieve their objectives.

Could you share the benefits of implementing Zero Trust architecture across different cloud services, and what impact it can have on overall security?

Implementing Zero Trust is a pivotal move. It’s all about never assuming trust, every user, device or service is treated as a potential risk until verified. By enforcing strict identity verification, segmenting the network, and limiting access to the bare minimum needed, it can drastically reduce unauthorized access and minimize attack vectors. In fact, it can noticeably reduce security incidents, especially when it comes to lateral movement within the network. It makes the system much more resilient to internal and external threats.

In a rapidly evolving threat landscape, how do you keep your network security team ahead of potential cyber threats? 

Staying ahead means being proactive, not reactive. So we invest heavily in continuous training and threat intelligence. I make sure the team is constantly upskilled and aware of the latest tools, techniques, and threat actors. We also conduct regular drills, like red team-blue team exercises, where one team simulates an attack, and the other defends. These drills keep us sharp and ready for real-world scenarios. Additionally, we partner with threat intelligence platforms to stay informed about the latest vulnerabilities and attack patterns.

Many organizations struggle with balancing security and performance. How have you achieved both in cloud-based platforms?

It’s always a challenge, but the key is building security into the system without making it an afterthought. We prioritise using security tools that don’t hinder performance, such as micro-segmentation, which isolates workloads without causing delays. We’ve also optimized our firewalls and VPN configurations to ensure they work seamlessly with the platform’s performance needs. Regular testing helps us find the balance between strong security and high-speed performance.

What has been the most complex security challenge you’ve faced, and how did you overcome it?

One of the toughest challenges was ensuring secure data transfer across multiple cloud environments without disrupting user experience. The complexity came from managing different security protocols across clouds while keeping everything unified. We tackled this by implementing end-to-end encryption, both at rest and in transit, along with a strong identity and access management (IAM) system. It took a lot of collaboration and trial and error, but in the end, we achieved a more secure and seamless experience.

You led the team that implemented best practices for firewall management. Could you explain the process and the tangible improvements it brought?

We started by conducting a thorough review of our firewall configurations and identifying gaps and inconsistencies across the network. From there, we standardized our firewall policies and automated rule updates, ensuring they were always up-to-date. This not only reduced human error but also improved our incident response time by around 15%. We saw a significant drop in misconfigurations, which are a common source of security breaches, and it made our security audits much smoother.

Phishing attacks are still a leading cause of breaches. What unique approaches have you taken to reduce user-related security issues?

Phishing attacks target human vulnerabilities, so awareness and engagement are key. We regularly run simulated phishing attacks to test and educate employees. It’s not about punishing mistakes but about learning from them. We provide immediate feedback to those who fall for the simulations, along with follow-up training. We’ve also gamified the process, rewarding employees who report suspicious emails. This approach has significantly reduced user-related incidents and made people more vigilant.

How do you ensure security measures are aligned with business objectives, especially in fast-growing digital product companies? 

The first step is communication. I make it a priority to sit with business leaders to understand their objectives and growth plans. Security shouldn’t be a roadblock to innovation, rather should enable it. By understanding the company’s goals, we design flexible security solutions that scale with growth. For example, as the company expands, we ensure that our security frameworks are adaptable and can support that growth without slowing things down.

Can you describe how you’ve integrated security into the DevOps process, and what lessons have you learned from working closely with development teams?

We’ve adopted a DevSecOps approach, which means security is part of every stage of the development lifecycle. Instead of coming in after the fact, we work with developers from day one to ensure security is built into the code. The biggest lesson I’ve learned is the importance of collaboration. Developers and security teams often have different priorities, so creating a culture of mutual respect and open communication is crucial. This has not only improved security but also sped up the release of new features.

What role do you think artificial intelligence and machine learning can play in the future of network security?

AI and machine learning are already making a significant impact in automating threat detection and response. These technologies can sift through vast amounts of data, identifying patterns and anomalies that would be impossible for humans to catch in real time. In the future, I see AI becoming even more integral to cybersecurity, helping us predict and prevent attacks before they happen. However, we need to remain cautious and ensure that these technologies are properly managed to avoid new risks.

Do you mean the AIs can also pose threats?

Yes, AI is going to come with its own challenges. Look at what is happening with deepfakes, where the voice and images of a trusted individual can be impersonated and used to commit fraud or can even be used to start a war. Attackers can now use AI to automate attacks, making them faster, more sophisticated, even Malware can now become more adaptive by using AI to evade detection. While we know we can use AI to increase defense mechanisms, AI can also be used by.

Cybersecurity talent is in high demand. How do you mentor and grow emerging security professionals within your team?

I believe in hands-on learning. I encourage my team members to take ownership of projects and learn by doing. We also have regular sessions where we share knowledge and insights. It’s important to create an environment where they can ask questions, experiment, and even make mistakes because that’s how they grow. I’ve seen team members evolve into highly skilled professionals simply by giving them the space to explore and lead.

You’ve led security awareness training. What are the key elements that make security training truly effective for employees?

The key is making it relevant and engaging. People are more likely to remember real-world examples than abstract concepts. We use case studies of actual breaches and interactive simulations to drive home the importance of security. It’s not just about ticking a box, it’s about making sure employees understand their role in protecting the company’s assets. By making the training interactive and rewarding, we’ve seen a marked improvement in awareness and vigilance.

With increasing regulations worldwide, how do you ensure compliance while maintaining strong security protocols?

It’s all about embedding compliance into the security framework from the beginning. We don’t treat compliance as a separate activity, it’s part of our daily operations. Regular audits, updates, and close collaboration with legal teams ensure that we stay ahead of regulatory changes. This way, we maintain strong security protocols without having to scramble when new regulations are introduced.

Looking ahead, what future trends or technologies in cybersecurity are you most excited about?

I’m excited about the rise of quantum computing and how it will change the game in encryption. We’ll need to develop new encryption methods to keep up with the power of quantum technology, but it also opens up incredible possibilities for faster, more secure communications. Additionally, the continued integration of AI in threat detection and the use of blockchain for secure transactions are trends I’m watching closely. These technologies will reshape cybersecurity as we know it.