Cyber Defense TV: Exploring Current Industry Challenges and Zero Networks’ Innovations

Summary 

Cyber insurance premiums rose because ransomware became an automated, lateral-movement-driven business model, and insurers responded with long checklists such as MFA for privileged activity and proof of segmentation. In this February 2024 Cyber Defense TV interview with publisher Gary Miliefsky, Zero Networks CEO Benny Lakunishok explains how agentless, automated microsegmentation closes privileged ports like RPC, SMB, and RDP by default and opens them only after MFA, so ransomware can’t spread. He also covers Zero Networks’ free open source tools, why Active Directory is a top target, and how Zero Networks Secure Remote Access avoids the drawbacks of both VPN and ZTNA.

Key takeaways

• Ransomware spreads through automated lateral movement, which drove insurer losses and stricter policy requirements.
• Zero Networks helps meet common insurer checklist items, including MFA for privileged activity and segmentation that can be validated with a pen test.
• Privileged ports stay closed by default and open only for a specific admin after MFA through the organization’s identity provider, so ransomware has no path to spread.
• VPNs expose an open port. Proxy-based ZTNA adds latency and cost and hides user IPs. Zero Networks keeps its WireGuard-based server invisible until a user passes MFA, then allows a direct connection.
• Zero Networks integrates with SIEM and EDR tools through an open API, webhooks, and vendor marketplace apps.

This interview was published in February 2024. Product names and details reflect Zero Networks at that time.

[00:18] Gary Miliefsky, Host, Cyber Defense TV, and Publisher, Cyber Defense Magazine: Welcome back to another exciting episode of Cyber Defense TV. I’m your host, Gary Miliefsky, publisher of Cyber Defense Magazine. Sitting in my hot seat today is a very special guest. Benny Lakunishok is the co-founder and CEO of an amazing company called Zero Networks, found online at zeronetworks.com, unifying internal and external network security and reinventing how segmentation and remote access are done. Benny, welcome back to the hot seat.

[00:45] Benny Lakunishok, Co-Founder and CEO, Zero Networks: Thank you, Gary.

Why are cyber insurance premiums rising?

[00:45] Gary Miliefsky: CISOs are worried about a lot of things lately: ransomware and all the different exploits, lateral movement, malicious insider behavior, data exploitation, data leakage. There’s a lot going on, and insurance prices are going up. Let’s start with cyber insurance. You can help our viewers and listeners get through the cyber insurance challenge a lot better than before.

[01:10] Benny Lakunishok: Before I explain how we can help, I think it’s interesting to understand why we’re here and what happened with cyber insurance, why premiums went up so much. Essentially, attackers got smart and figured out how to build a business model. With one-off attacks, finding someone interested in buying stolen data is hard. That still happens, by the way, many times. But now, if I steal your data, you’ll probably want to pay me a lot to get it back. Or if I take down the entire organization, you’ll pay me a lot of money to get it back.

[01:53] That’s the business model, and the party willing to pay the most is you, the organization. So they’re doing that to everyone. To make matters worse, the ransomware in use today relies on tons of lateral movement tactics that are now automated. They get in, they spread, sometimes simultaneously, put everything under ransomware, encrypt everything, and that’s it. The organization pays millions.

[02:25] So the combination of the business model, automation, and the fact that the root cause of the problem hasn’t been solved yet means we’ve had an explosion of these events. And what happened a few years ago is that insurance companies providing cyber coverage lost a lot of money. And guess what? Insurance companies don’t like to lose money.

[02:51] So they started handing out a huge list of requirements. They don’t really know how to solve the problem, so they’re throwing every buzzword they can at you: you need MFA everywhere, you need EDR, you need this, you need that. If you don’t have those things, you pay five or ten times more, because from a probability perspective, you’re a bad risk for them. Once you have them, you can get back to more reasonable premiums. That’s essentially what’s happening.

How does Zero Networks help organizations meet cyber insurance requirements?

[03:28] Benny Lakunishok: So what can we do? Some of the things insurers want as a checkbox before they’ll insure you are, for example, MFA for everything or MFA for privileged activity. That’s part of our unique microsegmentation solution, which also lets you apply MFA to anything you want. So we can do that.

[03:51] We can also segment everything, because we have an automated, agentless, easy-to-use microsegmentation solution. You can test it with a pen test, and the pen test comes back green. Sometimes insurers want to see pen test results too. They want to make sure you have the right segmentation, depending on the insurance provider and who they’re insuring. They may want several things, and we can help with many of them.

How does Zero Networks segment every asset in a single click?

[04:20] Gary Miliefsky: Benny, hold on. You can segment every asset in a single click? How do you do that?

[04:26] Benny Lakunishok: That’s the million-dollar question. It’s a combination of things, but basically we took a different approach to the segmentation, or microsegmentation, problem, and through a lot of hard work, we made everything that was hard easy. First, we’re agentless. That’s a big thing. We control the operating system firewalls and other controls to make sure there’s a network bubble around every machine, device, cloud instance, whatever it is. Being agentless is what makes it easier to deploy and maintain.

[05:00] Second, we have full automation, but real automation, without machine learning, AI, LLMs, or any buzzword like that. Real automation that’s very deterministic and knows what to keep open, so you can segment in a click. You don’t need a huge professional services lift to figure out how to create the rules and what to do. We just do it for you. Some of that is patented, by the way, and we also have a patent covering the things you don’t want to leave open.

[05:29] We can apply MFA to dynamically open access without pre-opening it for everyone. So we can require MFA for different types of connections and protocols. By default, we do that for privileged access, so there’s really nothing left for the attacker to do. All the things they love to do are gone, and you have to complete MFA for each and every one. Before us, it was all just open. That’s essentially how we make it easy.

How does microsegmentation stop worm-like ransomware?

[05:58] Gary Miliefsky: So say your clients were attacked by WannaCry or something similar that worms its way through. WannaCry was a worm and ransomware, the first ransomworm, and there are many more now. I’m sure people are using AI and machine learning, talking to ChatGPT, saying, “Fix this code, tweak this code, make it harder to detect.” Next thing you know, you get polymorphic malware ransomworming its way across networks. You wouldn’t allow that to happen because of your microsegmentation. How do you detect that and stop it so quickly?

[06:29] Benny Lakunishok: I don’t need to detect it. That’s the beautiful part. We take your network from very open to very closed, essentially a least-privilege model across the entire network, with a big emphasis on privileged ports: RPC, SMB, WinRM, WMI, RDP. People think RDP stands for Remote Desktop Protocol. It’s actually the ransomware deployment protocol. So we close all of that, and it stays closed.

[07:00] There’s no detection involved. When someone in IT or another technical role tries to do administrative work, we issue an MFA request through your identity provider of choice, and then we open access only for you. Ransomware typically doesn’t operate in the context of a real user, so there won’t be an MFA approval. It would need an MFA just to get to one machine, let alone a thousand machines.

How long does Zero Networks take to deploy?

[07:25] Gary Miliefsky: That’s amazing. So it’s quick to deploy, point and click, you’ve done the heavy lifting, and you’ve got patents on the technology. What’s the typical deployment cycle? How long does it take to get up and running to a level where a client feels confident? And do they deploy internally first and add remote access later, or can they do it all at once?

[07:46] Benny Lakunishok: Typically, a POC deployment is just a Zoom call with us where we deploy together. It usually takes an hour to an hour and a half. Then, depending on the customer and their needs, there may be another meeting or two to explain more about the portal, how things work, and what’s going on. That’s essentially it.

[08:06] After that first one-hour deployment meeting, you start pointing and clicking in the UI: “I want these 100 machines segmented.” You click, come back 30 days later, and it’s fully automated. They’re all segmented, with only what’s needed left open and MFA protecting the rest. It’s a no-brainer. For POCs, we call it the “Netflix-binging POC,” because you start it, go watch Netflix for a few weeks, and come back to find everything segmented.

[08:39] Gary Miliefsky: That’s amazing. And is the typical client critical infrastructure or the Fortune 500? What’s the sweet spot, from smaller to larger clients?

[08:50] Benny Lakunishok: I think every organization needs this. We have customers across SMB, mid-market, and large enterprise, in all verticals. There’s no type of customer we don’t work with today.

What free and open-source tools does Zero Networks offer?

[09:01] Gary Miliefsky: That’s awesome. Benny, you also offer free tools. You have open source tools, and you have TrustMeter. Can you tell us about the free tools and where people can find them?

[09:09] Benny Lakunishok: Yes. With many of the problems we tackle, Zero Labs, our research team, says, “This would be nice as an open source tool on its own.” So we release it. We have TrustMeter, which scans your entire network and gives you a report on how open it is, on a scale from zero to 100, with details of what’s open and various statistics. Think of it as Nmap, but easy: you double-click, it runs, and you get a report. You don’t need to mess with it.

[09:37] We have BlueHound, an orchestration tool for BloodHound and many other tools that brings their results into a single dashboard of risks and vulnerabilities. We have the RPC Firewall. RPC is a notorious protocol that, in some cases, you have to leave open, but you may want to go inline into that protocol and filter out the bad things. We actually did that, which is a huge thing. All of these capabilities are part of the product, but some of them are also available as free, open source tools to play with.

[10:21] We also added the LDAP Firewall. LDAP is a protocol used by domain controllers in Active Directory, so you can go inline there and filter traffic as well, among other things.

Why is Active Directory a top target for attackers?

[10:34] Gary Miliefsky: Is Active Directory really one of the weakest links in networks nowadays, and under attack more than people expect?

[10:42] Benny Lakunishok: I think everybody knows it’s being attacked, whether they expect it or not. It’s the keys to the kingdom, so it’s being attacked, and sometimes attackers succeed. Depending on the ransomware, sometimes they don’t target domain controllers at all; they just spread in a brute-force manner and take whatever they can. But many times the domain controller is targeted, as you’d expect if you’re going to attack. And that’s definitely another asset type we specialize in protecting.

What’s wrong with VPN and ZTNA for remote access?

[11:16] Gary Miliefsky: VPNs are typically wide open. There’s encryption, but they’re not segmented. And zero trust segmentation on its own is kind of confusing and complicated. Have you tied those together for remote access? Can you tell us how quickly and easily remote users can get in safely?

[11:36] Benny Lakunishok: Yes. Let me start with the problem, and then what we’ve created with [Zero Networks Secure Remote Access], which replaces both VPN and ZTNA. VPNs have a port open on the internet, and the VPN server typically has, let’s say, 3 million lines of code, so it will have bugs. Some of those bugs are remote code execution vulnerabilities. So essentially, anyone on the internet can get in if your VPN server is unpatched, or even if it’s patched and there’s a zero-day. That’s a huge problem.

[12:04] ZTNA solved that by putting a reverse proxy inside your network. It isn’t open to the internet; instead, it connects out to the ZTNA vendor’s cloud. When you want to connect in, you connect to the vendor’s cloud, and it piggybacks on that outbound tunnel to get back in. So you haven’t exposed anything on the internet, and you have remote access through a third party in a reverse-proxy manner. That’s great from a zero trust perspective, where zero trust means no open ports.

[12:38] The problem is that you’re completely changing the architecture of how you connect, and I think people are increasingly understanding the issues with that. To name the top three, though there are more: first, there’s much more latency and lower bandwidth, because you’re going through somewhere else instead of connecting directly. So performance and user experience are typically worse.

[13:01] Second, it’s much more costly. Cloud networking is expensive, and when you go through someone else instead of connecting directly, which is essentially free, they’re not going to absorb that bill. They’ll put it on your license, so it’s sometimes three to ten times more expensive.

[13:20] And lastly, that appliance is actually a NATed device. If you have 1,000 users connecting, they all appear to come from one IP address, which blinds all of your detection solutions inside. And there are other issues.

How does Zero Networks secure remote access?

[13:32] Benny Lakunishok: What we did was ask: how can we take the best of both? So we built a hybrid model. We have a VPN-style solution based on WireGuard, the most performant and secure platform out there, and it sits in the DMZ. So technically it has a port open on the internet, but in practice it doesn’t, because we segment it in a software-defined way, using its own host-based firewall to block it. Nothing can connect to it.

[13:59] When you try to connect, we check device attestation, MFA, everything. And once that’s done, we aren’t tunneling anything. We’re essentially telling that virtual appliance, our VPN server, to open its VPN port only to your public IP so you can connect. Then you have direct connectivity. You don’t change the architecture. It’s still direct, the most performant connection available, at least to date, while being zero trust. You’re invisible: your VPN server has no port open to the internet. And we provide all the other bells and whistles that a modern ZTNA provides. That’s what we do.

How does Zero Networks integrate with SIEM, SOAR, and XDR tools?

[14:42] Gary Miliefsky: That’s phenomenal. Benny, I’m curious. There are so many SIEM, SOAR, XDR, and MDR vendors out there, so many dashboards, so many points of entry and sources of information for cybersecurity executives and SecOps teams trying to figure out what’s going on, and a lot of noise. It sounds like you reduce a lot of that noise through microsegmentation and the other things you do. How do you play in that ecosystem? Do you augment these solutions? Do you pull in logs from them, or provide your logs to them? Where do you fit in the one dashboard to rule them all?

[15:18] Benny Lakunishok: We have an open API, webhooks, and a bunch of other ways to get all of our data into any SIEM, and we’re in the marketplaces of the major SIEM and EDR vendors. So in a click, you can integrate and share data both ways. If one of those platforms flags something as high risk, you can simply say “block that,” and we’ll require MFA for it or block it immediately. So there’s a lot of integration with the main security solutions in the industry, such as SIEMs, EDRs, and XDRs.

What should you consider before adding microsegmentation to your stack?

[15:56] Gary Miliefsky: That’s great. Benny, is there anything we haven’t covered that you’d like to share with our viewers and listeners?

[16:02] Benny Lakunishok: The only thing I’d say is that when you’re considering any change to your security stack, especially in microsegmentation, because I think that’s our biggest differentiator, ask how much time it will take. With some of what I call the legacy microsegmentation vendors, you need a lot of professional services, a lot of manpower, and a lot of time, and it’s not doable. If something is complex, it doesn’t get done. If it’s simple, it gets done. We make microsegmentation simple, so you can really move the needle quickly. So when you’re considering these potentially time-consuming projects, look for someone who can make them easy and fast for you.

[16:55] Gary Miliefsky: That’s wonderful. Benny Lakunishok, you are the CEO and co-founder of an amazing company, Zero Networks, making internal access, remote access, segmentation, and MFA so easy, point and click, that folks can get better deals on their cyber insurance, pass pen tests more easily, segment their networks for a safer, more secure experience, avoid losing data and being breached, and get one step ahead of the next threat. Thank you so much for sitting in the hot seat today. Folks, visit him online at zeronetworks.com, try out his free open source tools, check out TrustMeter, and come back next time for another exciting episode of Cyber Defense TV.

[17:34] Benny Lakunishok: Thank you.

[17:36] Announcer: Cyber Defense TV and Cyber Defense Radio have launched 24/7/365 live streams. Visit them online today at Cyber Defense TV and Cyber Defense Radio, with your host and globally recognized cybersecurity expert, my good friend Gary Miliefsky.