From Legacy to Leading Edge: Why Automated Microsegmentation is the New Security Standard

Summary

Legacy microsegmentation has failed for years for two reasons: it depends on customers knowing who needs to talk to whom, and it takes enormous manual work. At RSAC 2025, Zero Networks Field CTO Albert Estevez tells Security Weekly’s Doug White how automation fixes both. Zero Networks classifies every asset, generates the policies, and keeps privileged ports like SSH and RDP closed until a user passes MFA, all agentlessly, using the firewalls already on each host.

Key takeaways

• Legacy microsegmentation failed for two reasons. Few customers know which systems need to talk to which, and the manual work never ends. Automating classification and policy generation removes both problems.
• Inbound traffic is where to focus. Outbound connections are effectively infinite, but inbound traffic is finite, so automated inbound policies are manageable.
• Privileged ports stay closed until MFA. After the learning period, inbound SSH and RDP are denied. A user who passes just-in-time MFA gets the port opened for them alone, for an hour or two, and it closes automatically. Identity segmentation applies the same model to admin logons, so stolen credentials can’t log onto servers.
• It’s agentless and fast to deploy. Zero Networks orchestrates the Windows Firewall and iptables already on each machine. Setup takes about two hours, the first batch of policies arrives in 15 to 20 days, and teams can simulate them before enforcing.
• The real barrier is stigma. Legacy microsegmentation projects never ended. CISOs want a project with a start and a finish, and automation delivers one.

Speakers: Doug White, Host, Security Weekly (CyberRisk Alliance) · Albert Estevez, Field CTO, Zero Networks

---

Who is Albert Estevez?

Doug White: It’s Doug White, and we’re here at Security Weekly at RSAC 2020 2020. Did I say 202020? 2025. We’re having a little numerology thing going on today. Could be a bit weird. Uh, I am now joined by Albert Estevez Polo, who has 25 years of experience and a track record of being at the forefront of tech innovation, with expertise in quantum computing — and not a lot of people are willing to say that, but there are a few — uh, zero trust — not a lot of people willing to say that, but there are a few — uh, and, and microsegmentation strategies, which was one that we want to talk about a little bit more. Now, before, uh, before joining Palo Alto in 2011, uh, he developed the first migration tool, which would later become what is called Expedition. That’s like the, the tool that’s there now, and that’s a big one for firewall migration and optimization and all that kind of stuff. And Albert is the field CTO of Zero Networks.

Albert Estevez: That’s right.

Doug White: All right. Welcome, Albert. All the, all the way from Spain. So, how about that?

Albert Estevez: Thank you for having me here, man.

Doug White: Yeah. Well, thanks for being here after, like, a long flight and power outages [the April 2025 Iberian blackout] and all that kind of fun stuff that was going on yesterday. That was zero trust.

Albert Estevez: Yeah.

Doug White: I, I mean, I, I’ve, I’ve been in a few flights where I was there the moment we got off the ground and everything shut down behind us. Not, not quite that bad, but I, I was in ones where there were, like, weather and stuff, and they’re like, we got off the ground, and you’re all like —

Albert Estevez: That’s exactly what happened to me too, man. I realized when I landed what happened in Barcelona.

What is automated microsegmentation?

Doug White: Okay. So, one of the things that you brought up in your sort of prep that I was reading was this thing called automated microsegmentation. And, I mean, I understand perimeter security. I mean, I’ve built, you know, PIX, PIX firewall, ASA firewall. I mean, it’s not Palo Alto, but Cisco. And, and I understand that kind of perimeter security, and I’ve done that a lot. But I saw the term automated microsegmentation, and I, I said, “Okay, what does that mean?” And I, I wanted you to help me out with that.

Albert Estevez: Sure. I mean, so for many years people try to, you know, deploy microsegmentation solutions, but they mostly fail always for two reason. One, because it relies on the customer knowledge about who needs to talk with who, and this is really, you know, uh, rare to find between customers to have this knowledge, right? And the other one is that you need to do a lot of manual stuff. And I think that this is one of the two reasons that, uh, microsegmentation didn’t work out really well, you know, and that’s why it’s not adopted. So even that everybody says the microsegmentation will help you to really mitigate the lateral movement, you know, how you do it? So I, that we found the way — the only way that I will say that — is automating the entire process. So when we arrive to a network, the first thing that we do is classify all the assets that we are going to protect automatically. So we identify all the services, the processes, the operating system, everything which is inside the, the asset that you want to protect. And that automation as well help us to generate automatically the security policies that we need to provide to each endpoint, to be sure that you only talk with the people that you need to talk only, or for servers, tie the connectivity between only those two servers, or whatever the servers they are. And to do that, you know, we focus a lot in the inbound traffic. Okay? Because the inbound traffic is not infinite, right? Outbound, you, you name — you can go internet to do whatever you want. If I try to generate security policies to allow you every specific outbound connection, is going to be a nightmare. It’s going to be an endless job.

Doug White: Okay.

Albert Estevez: If you focus in the inbound, is easier. So it’s easy to protect you, you know, by generating security policies automatically, and then getting rid of all the privileged ports. So all the SSH, RDP — that we call it a ransomware deployment protocol — you know, try to get rid of them and block them at the host level.

How does just-in-time MFA protect privileged ports?

Doug White: Okay. So if I create a session — so traditionally — so I’m just, just so we understand this. I know you understand it. I want to make sure I understand. I want to make sure that they understand it.

Albert Estevez: Sure.

Doug White: So say it’s an SSH connection. Correct? So I got an inbound port 22 TCP connection from my house to some endpoint inside. How does that micro segment? I mean, so what is — I mean, I mean, obviously I know how to do that on a firewall. So I can put ACL rule in that says allow port 22 TCP. Yes. But that’s not microsegmentation.

Albert Estevez: No. And, and this is a perfect example, because SSH for us is a privileged port. Okay? It’s a port that if you take ownership — you utilize it, you will get ownership of the machine that you are connecting, right? So what, what do we do? So when we are learning all the communications, we are going to detect that you are contacting to this SSH server from whatever the IP you have. What is going to happen in 30 days, after the learning process finishes, we are going to deny the inbound traffic for the SSH, and now what we are going to do is we are going to generate an MFA just-in-time policy for you.

Doug White: Okay.

Albert Estevez: So what is going to happen is, you, from home, you’re going to try to connect to your SSH. That packet is going to be dropped by the iptables that you will have in that Linux server, but we are going to capture the drop, and based on the drop, I compare against the policy. So if the policy says that allows you to connect through MFA, I will send you an MFA. You first authenticate against your MFA, and once you do that, right, then, only then, I will contact the server to open for you the port for an hour, two hours. So this is the most secure way to, like, not knocking the door.

Doug White: Yeah.

Albert Estevez: Right? So you first authenticate — perfect — and then I open you the door only for you, not from anybody else.

Doug White: And, I mean, so that is a dynamic way. I mean, because we used to try to do stuff like that. So I always had rules in firewalls when I was doing jobs as a consultant. I would go in and put rules in that allowed me to get in, because I need to be able to get in from wherever. Some people didn’t like that. But, but that rule was dynamic —

Albert Estevez: Yeah, that was a static. So it was working 24/7.

Doug White: That rule was always there.

Albert Estevez: Yeah. That’s why lateral movement happened, right? Because when you bridge into a network through one machine, you have firewalls, but those firewalls have security policies that allows traffic 24/7.

Doug White: It’s easy to do. And is that being maintained by, like, a token on the packet level?

Albert Estevez: No. So we keep all that knowledge, you know, in our back end. And every time that we generate a security policy that is, uh, temporary, the system automatically removes them after the time, uh, expires.

Doug White: Okay.

Albert Estevez: So it’s all dynamic. So you don’t need to do anything.

Doug White: Okay.

Albert Estevez: This is the approach that I think that is the only way that I see preventing lateral movement through microsegmentation, is by providing this type of capabilities. Automation to classify all the endpoints, automation to generate security policies, and now make security policies dynamic based in MFA. This is game changer.

How does Zero Networks generate policies so fast?

Doug White: Oh, that’s very nice. Uh, it’s awesome. I mean, that, that definitely facilitates a lot of the traditional problems that, that we had, because one of the issues — so I know you want to talk a little bit about zero trust. One of the problems we had with sort of early zero trust ideas was going to a client and saying, “I really want to shut everything down.” And they’re saying, “I want to open everything up, and then let’s pick the things that are bad.” And I’m like, that’s not really the best way to do this. It would be better to close everything and then open the port you tell me. And that was really difficult to do, especially for production systems. But so how, how does this work to facilitate that?

Albert Estevez: So we, we have then a, an engine, you know, that is provided by knowledge experts, and when every time that we detect new communications, new services, we already know for a lot of them what are the security policies that we need to put in place.

Doug White: Okay.

Albert Estevez: So this speeds up the, the generation of the policies, based on the, the expertise that we collected from many years of working with networks. So, you know, if you have a cluster of Active Directories, you know which ports you need to enable between them in order to work, right? So we use this engine to generate and speed up the generation of security policies, which is really, you know, differentiating.

How does agentless microsegmentation work?

Doug White: So I would feed that in from day one to your engine, and then your engine’s going to build that dynamic security policy into — that’s in my Palo Alto, like, workspace control system, or where, where does that sit?

Albert Estevez: Our solution, what it does is orchestrates firewalls that they already deployed in the customer network. So we don’t need to deploy anything, like —

Doug White: Okay, so that’s standalone. So —

Albert Estevez: It’s agentless. It’s totally agentless. So it’s frictionless for deployment, and even for testing, because you have already all the technology in place. So if it’s a Windows machine, we are going to utilize the Windows firewall. If you have Linux machines, we are going to utilize the iptables. So it’s something that you already have in place, and the only thing that we are going to do is automate the whole process and orchestrate it like nobody did before.

Can microsegmentation stop AI-driven attacks?

Doug White: Do you, do you think that, that AI coming into the sort of attack space, which we’re starting to see — this, this should help resist that, because the AI is always trying to find that snaky — where are there open ports? Are there places for lateral movement? So that actually would be kind of stopped, I guess? I, I mean —

Albert Estevez: So what we, what we think is the best approach, following zero trust frameworks, is least privilege approach, right? So try to close everything down. Only open when it’s needed. And if the port that you’re trying to connect is privileged, first do an MFA in order to be open for you. You know, if you do this, this is really hard for an AI system to try to find out a way to find a short path, because now nobody trusting anybody. All the inbounds, everything closed.

Doug White: Yeah.

Albert Estevez: You know, so it’s really hard to someone to do — try to do lateral movement, even using whatever they want.

How does identity segmentation stop stolen credentials?

Doug White: Yeah.

Albert Estevez: Because all the ports are closed. And something even we, that we did, we extended now network segmentation to identity segmentation as well. So we can even tell that your administrators, they cannot log onto your servers. So if someone steals your credentials, they will not able to log onto the server, because now the system is denying the access.

Doug White: Okay.

Albert Estevez: And then what we do is we offer a mechanism through an MFA. So if you authenticate through an MFA, then I will add you to allow you to connect to that server. So imagine how we are reducing the attack surface. So now the port is closed, and you require MFA to get visibility of the port, and at the same time, I can add you, you know, in the logon to do the login. But first you need to prove that you are you. So this is the best example of least privilege, you know, apply to —

Doug White: Of course. And I mean, that’s, that’s still — there’s still an identity management problem there, but the MFA is helping to leverage all that against the — yeah.

Albert Estevez: Yes.

Doug White: What kind of MFA is that using?

Albert Estevez: So we integrate with any SAML solution out there.

Doug White: So whatever. Yeah.

Albert Estevez: So whatever. Okay. So even we have customers that they develop their own, but as soon as it’s SAML 2, we can integrate with any.

What does deploying Zero Networks look like?

Doug White: But when people want to implement this, what’s that path look like, going from — I, I mean, some of this is just zero trust, but I mean, when you start with, like, say, a midsize company, and you say we want to go from — right now we’re doing Doug’s model of, I open port 22 and allow traffic — to something like this. And, and say we have Palo Alto. I, I mean, I, I know that’s, that’s part of your, your background. So what’s that sort of process like? I, I mean —

Albert Estevez: So usually it doesn’t matter what is the vendor that you have, even that we have a really cool integration with Palo Alto.

Doug White: Yeah, it wouldn’t — the hardware wouldn’t matter, I guess. Yeah.

Albert Estevez: So because at the end of the day, because we are in the endpoint, learning from the endpoint perspective, the traffic needs to be allowed everywhere in order that the communication happening, right, from endpoint to endpoint. So we can learn and then generate the security policies to be applied at the, at the endpoint level. So now that you are shrinking the security policy at the host level, you know, whatever the policy is in between is, like, less risky, because what we seen in the field, the customers, they do do a really good job by generating security policies, even less when it’s in the same segment, which is nobody is applying security policies.

Doug White: So, so the — so just, just to get some steps. So the, the one of the first steps would be to just develop your commitment to zero trust. So, I mean, this is how I do it. You got to convince me you’re committed to this. Then we develop security policy that sits there, that this is going to be what do we know we want to do, and how do we control those users’ access, and so forth. And then once we’ve done that, we can put this into the engine, and the engine can then allow these, these connection.

Albert Estevez: It’s even easier, because what the first thing that we — so deploying Zero Networks, it takes, like, two hours, you know.

Doug White: Okay.

Albert Estevez: Because — and the hardest part is to get a virtual machine already installed with a, with a Windows server. This is the hardest part.

Doug White: Wow.

Albert Estevez: So once you have that, we integrate already with your, you know, uh, Entra or Active Directory, whatever. So then we do the discovery automatically. So we classify already your identities.

Doug White: Yeah. Just happens automatically.

Albert Estevez: And then you decide which machines you want to start monitoring, to start learning. And just because we don’t need to deploy any agent, we establish communications with all the assets, you know.

Doug White: Is that an agent that you put on the machine?

Albert Estevez: No, nothing. We establish a communication.

Doug White: Okay.

Albert Estevez: WinRM or SSH.

Doug White: Okay.

Albert Estevez: So we connect to each machine, and then we start collecting all the information. Okay? So, and then from that moment, our engine starts learning, and in 15 to 20 days, you get the first batch of policies that you can validate. You can simulate before apply, to see, hey, this thing — yes. And then as soon as you get confident, you apply them. Usually, when you deny the inbound, for example, for your clients —

Doug White: Customers.

Albert Estevez: If you deny the inbound, nobody will notice.

Why isn’t everyone doing microsegmentation?

Doug White: So I guess what I would get to, then, with that is, so why aren’t people doing this? I, I mean, this, this just — I mean, I remember my way was like, we’re going to do this, and you’re going to live with it. Get over it. Quit whining. But this sounds like it’s very doable, you know, in terms of even, like, a midsize or something could, could, could go this route. Why — what are the barriers to people doing this?

Albert Estevez: So the barriers is, uh, we have to deal with the stigma of the word microsegmentation, you know, because, again, so legacy companies out there, they try to sell you microsegmentation for many years, and the only thing that I think that they generated is a lot of cha— chaos, problems, and even project that they are endless, you know. It is a lot of ROI that you need to invest. You need to put a lot of people, professional services, to make it work. So at the end, the CISOs, they want to see something that is doable and has a start and has a finish. And the majority of these projects, you are not using automation, is, you know, that you’re going to start tomorrow, but you don’t know when you’re going to end, you know. This is what we are breaking. Again, this very disruptive.

Doug White: Cool. Well, thank you, Albert, for joining us. Albert from zeronetworks.com. You can go there and check this out. You can also go to securityweekly.com/zeronetworksrsac. Thanks for joining us. Keep hanging around. We got more content to come. Thank —

Albert Estevez: Thank you.

Doug White: Thank you. Yay. Thank you.