Demystifying Zero Trust: An Expert’s Insights on Implementation and Impact

Summary

Zero trust means every connection is closed by default and opens only temporarily after strong authentication, such as MFA, and applying that principle inside the network, between every machine, is what microsegmentation does. In this June 2023 interview at Infosecurity Europe, Zero Networks CEO Benny Lakunishok explains that adoption has lagged because deciding what to allow on every machine is a manual, human problem, and that Zero Networks automates those decisions so organizations can segment every machine without agents. He also covers where to start, how long deployment takes, and how CISOs can build the business case around ransomware, compliance, and pen test results.

Key takeaways

• In its original sense, zero trust means one machine can’t communicate with another until it strongly authenticates, for example with MFA, and then only temporarily.
• ZTNA applies that idea to remote access, but the same principle has to apply inside the network between all machines, which is microsegmentation.
• Attackers typically start from one compromised machine and spread because internal networks are open. Closing those ports limits ransomware to one or two machines.
• Adoption has been low because manually deciding what to allow on every machine is impractical. Zero Networks automates those decisions, is agentless, and uses MFA for access that shouldn’t be statically open.
• Start with something rather than waiting for perfection, and aim to cover every machine, because protecting only the crown jewels leaves other paths for ransomware.
• Ransomware, compliance requirements such as PCI DSS, pen test findings, and unpatchable vulnerabilities all help build the business case for microsegmentation.

This interview was recorded at Infosecurity Europe in June 2023. Statistics and forecasts cited reflect that time.

[00:06] Interviewer, Infosecurity Magazine: Hello, everyone, and welcome to this Infosecurity Magazine video interview here at Infosecurity Europe. I’m joined today by Benny, the CEO of Zero Networks, and we’re going to be talking about a zero trust network architecture approach. Benny, thank you for joining me.

What does zero trust actually mean?

[00:24] Interviewer: I think the first thing we should discuss is the zero trust approach. It’s something that’s been discussed and talked about a lot. What are your thoughts on it? How is it being implemented?

[00:39] Benny Lakunishok, Co-Founder and CEO, Zero Networks: Sure, and thanks for having me. First, let’s debunk those two words, which are unfortunately used, or abused, almost too much in the industry. The words “zero trust” were actually around in the nineties, believe it or not, before people started using them broadly in cybersecurity. It was a DoD organization, and it meant that before machine A can communicate with machine B, everything is closed. Machine A needs to authenticate with some third party in a strong authentication fashion, like MFA, and only then can machine B open that communication port to machine A, and then they can communicate temporarily. That is zero trust, period.

[01:22] Now, the industry has taken that into something called ZTNA, zero trust network access, which is the VPN replacement. Essentially, how do we have the VPN or remote access open without actually opening the port, like the machine A and machine B example? That’s great, but people often forget that you need to do the same thing inside the network, between all machines. That’s the core, the essence of real zero trust, and it’s extremely hard to do. That’s essentially segmentation, or even microsegmentation, which so far has been extremely hard to do. At Zero Networks, that’s what we make easy.

Why does zero trust matter for today’s threat landscape?

[02:01] Interviewer: With that segmentation approach and implementing zero trust, how does that fit with the current threat landscape? Why is it important when the threat landscape is evolving and changing all the time?

[02:17] Benny Lakunishok: Great question. Statistically, if you look at 90% of attacks, they all start with a compromised laptop, from phishing or whatever. Because the inside of the network is fairly open, the attacker can start using various tactics to spread throughout the machines in the environment. With a zero trust approach, again using it in its core meaning, if all of the ports on all of the machines are closed, essentially blocking inbound communication, and the machines don’t trust each other, then attackers cannot spread. They cannot do anything.

[02:51] So it’s very relevant to the threat landscape. Specifically, in the last few years, ransomware has become highly automated, using tons of vulnerabilities that exist on these open ports. If you close those ports down, guess what? Ransomware is dead. It can only compromise one or two machines, not the organization. It’s a completely different situation.

Why is zero trust adoption so low?

[03:13] Interviewer: So in principle, it sounds quite simple: you block things off, and it stops people. How widely adopted is it?

[03:23] Benny Lakunishok: It’s not. According to Gartner, by the end of 2023, it’s actually less than 5%, and I would even claim it’s less. The reason it’s so hard is that if you take this approach of blocking everything inbound on every machine by default, what do you allow, and who gets to decide? That becomes a very human problem, because then you need security operations or network security operations teams to start allowlisting, per individual machine in the organization, to open things up.

[03:56] Nobody’s going to do that. It would be crazy, which is why everyone says, “Okay, let’s keep it open. I don’t want to [mess] with that.” That’s why nobody has implemented this so far. The manual operation, the human element, is the Achilles’ heel.

How does Zero Networks make microsegmentation easier?

[04:12] Interviewer: So how are you at Zero Networks trying to change that, or help people with a problem that’s just too hard and too much to deal with, that human element?

[04:27] Benny Lakunishok: That’s exactly what we set out to do. I left Microsoft, where I was leading product for Microsoft’s EDR, one of the best EDR platforms in the world, and I understood that nobody was solving the problem of why attackers are winning. To microsegment in a click, there are actually multiple things, but the biggest one is automation, without the AI, for a second. We took this big problem of knowing what to keep open per machine, and we humanized that approach by splitting it into smaller and smaller problems, deciding whether we need to open each thing, yes or no.

[05:04] So essentially, in a click, we know how to automate what to keep open. We can do that throughout the environment, and it’s super accurate. That’s the core thing that lets any organization scale microsegmentation in a click. There are other things, too. We’re agentless, which really helps. And we have dynamic, self-service access. There are certain things you never want statically open or closed; you want them available on demand, based on strong authentication or MFA. So we have that as well.

Where should organizations start with zero trust?

[05:39] Interviewer: I often ask this, because our audience might be thinking, “We haven’t even started to think about this,” or, “We’ve thought about it, but we haven’t started the process.” Where’s the place to begin implementing microsegmentation and zero trust network architecture?

[05:57] Benny Lakunishok: Good question. First of all, perfection is the enemy of the good. Start with something, usually the low-hanging fruit. With zero trust overall, there’s the external piece and the internal piece. You might think it’s half and half, but it’s not: from a security posture and risk mitigation perspective, the internal piece is much bigger, although the external piece is more popular and easier to do. Just pick one. Either a modern ZTNA, which also has problems that we’ve innovated on, or the internal piece.

[06:31] For the internal piece, pick a solution that’s easy. You could potentially start with your crown jewels, although I feel that would quickly prove not to be enough, because ransomware or something else will spread to other machines that have access to the crown jewels. So you really want all machines, clients and servers, on premises and in the cloud, completely microsegmented, and you need a solution that can scale. Those are the two things I would start with.

How long does microsegmentation take to implement?

[07:01] Interviewer: And how long does that segmentation process take? Obviously, it’s not just a flick of a switch.

[07:07] Benny Lakunishok: Well, I’m biased. With what I call the legacy microsegmentation vendors, it takes months or years, depending on the organization’s size. It can be very tedious and hard. With us, we call it “zero to hero in three meetings.” It’s one hour to deploy, one hour to see the automation happen, and then, after a month, one more one-hour meeting, where everything you choose automatically moves to protection, or segmentation, mode. And that’s it. You can literally binge Netflix for that month and watch everything happen for you.

How can CISOs get stakeholder buy-in for microsegmentation?

[07:45] Interviewer: Going back to the human element within the business, how can the CISO get buy-in from other stakeholders that this is something that needs to be done?

[07:59] Benny Lakunishok: There are multiple use cases to talk about. Obviously, ransomware is a big issue today, so that’s one. Some organizations need to meet regulations like PCI DSS, which microsegmentation can help with. Or they need to pass a pen test. A pen test report can be very red, with a lot of bad findings, and microsegmentation done right, which is the key, can turn it almost completely green. We do that all the time.

[08:31] There’s also better segmentation and better controls that can really stop attackers, and risk reduction for vulnerabilities you cannot patch. Guess what? If you microsegment them off, attackers cannot reach them, so they cannot exploit the vulnerability, and patching becomes almost non-critical. Those are some of the things that can get more people on board.

What does the future of zero trust adoption look like?

[08:57] Interviewer: Finally, let’s go back to what you mentioned at the beginning: the slow uptake and the really small percentage of organizations actually implementing zero trust. Do you see that changing? How do we get that above 10% or 20%? What does the future of zero trust and zero trust network architecture look like to you?

[09:19] Benny Lakunishok: I feel this is accelerating super fast. I actually read a couple of days ago that Gartner says that by 2026, 60% will have it. So it’s accelerating. There are now solutions modernizing the approach to make it really easy, because people only do it if it’s simple. If it’s hard, they usually don’t. So there are more and more solutions that make something like this much easier. That, plus the pressure from ransomware and other threats that spread and take down an environment in a few minutes, will make adoption much faster, I think.

[10:01] Interviewer: Great. Thank you so much for joining me, Benny, and for sharing your insights into zero trust. That was really excellent. For more news from Infosecurity Europe and all the cybersecurity updates you need, please head to the Infosecurity Magazine website. Thank you so much for watching.