Baron Capital CISO Henry Mayorga on Zero Networks

Summary

Baron Capital CISO Henry Mayorga segmented his network with Zero Networks after core firewalls didn’t give him enough control, VMware NSX proved too complex, and other microsegmentation products broke the network. Zero Networks manages the Windows Firewall already on every machine, so there are no agents to deploy. It learns normal traffic patterns and builds the policies itself, so locking out everything else becomes straightforward. Instead of the weeks or months a typical rollout takes, Baron Capital turned on a few rule sets around the network core, gained visibility into communications it didn’t know existed, and secured both desktops and servers. Despite repeated attempts, his team couldn’t break it.

Key takeaways

• Pen tests recommended segmentation, but core firewalls segmented only by business unit and didn’t provide enough control.
• VMware NSX was too complex, and other products Baron Capital tried broke the network.
• Zero Networks is agentless: it intelligently manages the Windows Firewall at scale, using technology already on the network for 20 years.
• By learning normal traffic patterns and building policies automatically, it revealed unexpected communications and made locking everything else down straightforward, for desktops and servers alike.
• Deployment meant turning on a few rule sets around the network core rather than spending weeks or months rolling out software, and Mayorga’s team couldn’t break it.

[00:00] Henry Mayorga, Chief Information Security Officer, Baron Capital: It’s an elegant solution. Elegant solutions are, by nature, very simple, and that’s what makes them very special. That’s what Zero Networks is: an elegant and simple solution for a very difficult problem.

[00:21] My name is Henry Mayorga, and I am the Chief Information Security Officer for Baron Capital. We are a long-term investment firm here in New York City. I have more than 35 years of experience in IT with many different Wall Street institutions.

Why did Baron Capital need network segmentation?

[00:37] We had a number of different penetration tests, and the recommendation that came back to us was that we needed some form of segmentation to separate the different areas of the network. We actually bought firewalls, put them in the core of the network, and broke it into little segments. Each segment was maybe a business unit. That gave us some level of comfort, but not the level of control we needed.

[01:00] We tried NSX from VMware, and that proved to be too complex. We looked at a couple of other companies, and they broke the network. They broke the network. I couldn’t get basic ARP to work. So we stepped away from that and went back to our firewall scenario, until I got hold of Zero Networks.

What was Baron Capital’s first impression of Zero Networks?

[01:23] My first impression of Zero Networks, I should say, is that it was too good to be true. I had already thought about the possibility of managing the Windows Firewall for segmentation, and I knew it was very difficult to do. I didn’t think it would work.

[01:37] But then we actually tested it, and we ran it, and I put you guys through the wringer. I demanded a lot, because I didn’t believe it wouldn’t break my network, or, more importantly, my applications. And it didn’t.

How does Zero Networks segment the network without agents?

[01:54] One of the main features I like about Zero Networks is that it doesn’t require any agents. It’s actually using technology we already have, technology we’ve had on the network for 20 years. For as long as we’ve had firewalls, we could have done this. We just couldn’t manage the firewall at scale, and we couldn’t manage it intelligently. So we had every piece of the solution already there. What we did not have was the brains that Zero Networks brought into the process: the brains to understand the traffic and create the rules around it.

[02:27] The value proposition of Zero Networks for us was that it was capable of doing something no other product had done, which is to really understand and learn what the network is. It basically builds the policies itself. When we deployed it and saw what it was learning from the traffic patterns, we realized this is the right approach. If you understand the normal flow of traffic on the network, then locking everything else out is pretty straightforward. It’s not simple, but it’s straightforward.

How long did the Zero Networks deployment take?

[03:00] Typically, when you deploy a solution like this, it may take weeks, even months, before you get all the software out there and test everything. With this, it was basically a matter of turning on a few rule sets around the core of the network and then stepping back and watching the system operate.

[03:19] We learned so much about our network. There were a lot of things we didn’t know about it, and we also saw communications that shouldn’t be there and that we needed to lock down. You don’t get to do that unless you have a way to visualize that traffic and understand the traffic patterns. Without deploying anything beyond what we already had on the network, we were able to do that, not just for desktops but also for servers.

[03:43] That, and the ease of deployment, is really something that was shocking to me. I didn’t think it was going to work. I really didn’t think so. I kept asking my guys, “Let’s break it.” I was looking to break it. I said, “Let’s break it, there’s got to be a way around this.” We tried, but we couldn’t break it.

Why does Baron Capital trust Zero Networks as a company?

[04:04] I’m going to say something that’s important for you to understand. Zero Networks as a company isn’t just a product to make money. Zero Networks has software that we use for our own benefit. BlueHound and the RPC Firewall are tools that Zero Networks developers have released to the public that benefit all of us, and you can’t say that about a lot of companies. There are a lot of marketing companies out there, but very few really care about protecting you. I feel that Zero Networks isn’t just building a product; it’s taking an ethical approach to protecting my environment. That’s very important to me.