Aaron Goodwin of B.Riley Financial talks about Zero Networks

Summary

B. Riley Financial brought in Zero Networks to stop an attacker who compromises one machine from escalating across the environment. CISO Aaron Goodwin explains how Zero Networks learned system communications and moved hosts into protection quickly. Protected hosts then stopped the same internal penetration-test attack sequences the team hadn’t been able to block before.

Key takeaways

• The goal was to stop escalation from a single compromised machine. B. Riley needed to lock down which systems could talk to which, so an external attacker who grabbed one unit couldn’t climb through the environment.
• It works as advertised. Zero Networks learns the rules and communications between systems and users, then moves them into protection rapidly.
• Pentests proved it. Attack sequences from B. Riley’s internal penetration testing system that the team couldn’t previously stop were stopped on hosts in protection.

Speaker: Aaron Goodwin, CISO, B. Riley Financial

What problem did B. Riley Financial need to solve?

Aaron Goodwin: The big things we were trying to solve with Zero Networks was really around the insider threat situation, which allows for an external counterpart to grab hold of a particular unit and be able to climb or escalate itself throughout the environment. So we’re really trying to stop that insider threat and really lock down what systems could talk to which systems. We believe Zero Networks was a really good piece of the puzzle for that situation.

My name is Aaron Goodwin. I’m the Chief Information Security Officer for B. Riley Financial. B. Riley Financial is a multi-diverse financial institution headquartered out of Los Angeles, and we have many offices across the United States and now starting to do some global work as well.

How does Zero Networks’ learning work?

Aaron Goodwin: I love several things about Zero Networks’ platform. When it comes down to the way that the product works, it works as advertised. Products go into learning, it learns all the rules and communications between the products and the systems for particular users or other groups of systems quickly, and allows those things to go into protection rapidly, and allow us to get those protection results we were needing. It’s been very beneficial to the organizations thus far.

What happened when B. Riley Financial ran penetration tests?

Aaron Goodwin: I think the biggest thing for us was we were using an internal penetration testing system for quite some time, and there are some things that we just couldn’t get the bugs worked out of the network. We were having some problems where we could not stop some of the traffic, and turning it off and could have deprecated some potential areas of activity within the environment. So what we did is, once we had Zero Networks in play, we were able to put some machines to protection after a learning period, and once they were in protection, we decided to run the same type of attack sequences against those hosts that were protected, and we were able to stop those activities from occurring, which was a big testament to what we had heard about the product and also about what we were learning by administering the product.