CISO Series: Why a Flat Network Is an Open Door for Attackers

Summary

BBR Partners swapped a patchwork of RDP lockdowns and bolt-on MFA for Zero Networks’ automated microsegmentation. Three years later, its CTO calls it “set it and forget it.” In this CISO Series conversation, producer David Spark talks with BBR Partners CTO Scott Ehrlich and Zero Networks VP of Customers Nicholas DiCola about starting from a flat network, earning trust with a 30-day trial, and pentests that reported lateral movement was very difficult.

Speakers: David Spark, Producer, CISO Series · Scott Ehrlich, CTO, BBR Partners · Nicholas DiCola, VP of Customers, Zero Networks

What did BBR Partners try before Zero Networks?

David Spark: We’re talking about microsegmentation and you work — I’m sorry, where do you work? You don’t work for Zero Networks.

Scott Ehrlich: I work for a company called BBR Partners. We’re a wealth management firm. We service the needs of clients that have in excess of $50 million.

David Spark: Did you have any kind of microsegmentation setup?

Scott Ehrlich: I tried to do things that Zero Networks could do.

David Spark: What did you try to do?

Scott Ehrlich: I tried to, like, lock down, like, RDP. We tried to add on, uh, different types of MFA.

David Spark: You were creating a Frankenstein monster that was falling apart.

Scott Ehrlich: Yeah, pretty much.

How did BBR Partners come to trust Zero Networks?

David Spark: So, how did you find out about Zero Networks?

Scott Ehrlich: Got in contact with them. Went through a couple demos. Nick [Nicholas DiCola] said to me, “Let us do a P**[OC]** for 30 days.” I said, “You got to earn my trust.” And here we are today, three years later, happy customers. [CHECK: captions read “a P for 30 days”; confirm it’s “POC.”]

David Spark: Do you remember — were you with the look at their environment three years ago? [CHECK: captions are garbled here; confirm the wording against the audio.]

Nicholas DiCola: Yeah. Yeah. Absolutely. Scott did not believe me, nor did, uh, the folks at BBR. It was pretty funny. It was — it was a “hey, trust me” moment. And, uh, it worked out really well.

Why are flat networks so common?

David Spark: I’m sure there’s many companies like yours, a situation where they want to do the right thing, but they’re just stepping on their own toes.

Nicholas DiCola: [CHECK: speaker. “We get tasked with, hey, set up this application” sounds like a practitioner, so part of this turn may be Scott.] Customers want to do the right thing and the tooling’s not there. So, they just have a flat network and it’s wide open. So, you can imagine if you’re an attacker and you walk into a neighborhood and every door is open — guess what? You’re into every house. It’s very common in networks, right? Because we get tasked with, “Hey, set up this application, set up this server,” we just want to make it work. And really, TCP/IP was designed to talk.

David Spark: So, you were essentially looking at a flat network when you were looking at his company.

Nicholas DiCola: Yeah, absolutely. It was very flat. Again, very common to what we see. They had tried some things — “hey, we had some MFA on some login.” They tried a couple other things, maybe some light segmentation here and there, but definitely the doors are wide open in many customers that we see.

What did success look like?

David Spark: When was the first moment you saw some success working with Zero Networks?

Scott Ehrlich: Developers complaining to me means we’re — we were successful. Um —

David Spark: Oh wait, I’m not going to let you walk away with that. What did they complain about?

Scott Ehrlich: A couple extra seconds out of their day to go through a few extra steps to get to where they wanted to go. But in the end, when you explain to them why we’re trying to do this — that if their creds were ever stolen — then it made sense.

David Spark: Sometimes you need to slow things down.

Scott Ehrlich: Yes. And then the ultimate form of success was running the pentest. We’ve had two pentests since we implemented Zero Networks, and each time it’s actually gotten better. We’ve never had any serious vulnerabilities, no, um, uh, high vulnerabilities. And each pentest, there was part of the report that said, “You guys have something in your network that is making it very difficult to move laterally.”

What’s the hardest part of deploying microsegmentation?

David Spark: What was the hardest thing about working with their environment?

Nicholas DiCola: Uh, trust. People don’t believe it. They’re like, “You’re going to break my network.” And, you know, nobody wants to break their network. We don’t want to break their network. That’s our number one goal. But it’s always trust in every environment. You have to build that confidence with them to show them, like, look, we can build the rules. We’ll do it without breaking the environment.

What changes after microsegmentation is in place?

David Spark: Is there a next evolutionary step in the relationship, or is it just let’s keep doing what we’re doing?

Scott Ehrlich: It’s been almost like set it and forget it.

David Spark: What don’t you need to do anymore, I guess, is my question.

Scott Ehrlich: I mean, you don’t — when a machine gets on the network, it’s automatically getting segmented, ’cause all the rules are in place. So, we don’t have to do anything. We allow what we allow and everything else is locked down.

What’s next for Zero Networks?

David Spark: What are the cool new things Zero Networks is showing off?

Nicholas DiCola: Yeah, we started in prevention because that’s number one goal. Now we’re adding detection — being able to alert on the traffic — being able to control AI agents in the network and stop them from being able to sprawl, go out to the internet, do those types of things, and get that AI control. Those are probably the big two that I’d mention in the short time frame.

David Spark: Check out what they’re doing at Zero Networks. Look, it’s right there. zeronetworks.com. How much more do you need to know?

Key takeaways

• DIY controls became a “Frankenstein monster.” Before Zero Networks, BBR Partners was locking down RDP and bolting on MFA piece by piece, on a network that was still flat.
• Trust was the real hurdle, and a 30-day trial cleared it. Teams fear microsegmentation will break the network. Zero Networks built the rules without breaking BBR’s environment, and BBR has been a customer for three years since.
• The friction was small and temporary. Developers lost a few seconds to extra MFA steps and accepted it once they understood that stolen credentials couldn’t travel. Today new machines are segmented automatically: “set it and forget it.”
• Pentests got harder for the testers. Across two pentests since deployment, BBR had no high vulnerabilities, and both reports noted that something in the network made lateral movement very difficult.
• Next up: detection and AI agent control. Zero Networks is extending from prevention into traffic alerting and stopping AI agents from sprawling across the network or out to the internet.