Reference Laboratory’s Experience as a Zero Networks and Palo Alto Networks Customer

Summary

Reference Laboratory was one of Palo Alto Networks’ first customers in Spain, and CISO Miguel Angel Amigo says Zero Networks gave him the same sense of innovation Palo Alto did 15 years ago. He explains how Zero Networks automatically builds segmentation policies his team calls “black magic,” requires MFA for every privileged process, and feeds tags into Palo Alto Networks firewalls so static policies become dynamic.

Key takeaways

• Policies build themselves. Zero Networks reads network traffic, tells service accounts apart from user accounts, and creates a different policy for each type of server, such as email servers and databases. Reference Laboratory would otherwise have done this by hand.
• Policies keep improving. When another machine on the network shows the same traffic, Zero Networks alerts the team and applies the existing policy to it.
• Every privileged process requires MFA. Any process that runs with an admin account, locally or across the network, must be validated with MFA. The team knows every privileged action was run by an administrator.
• Security moved inside the VLAN. Reference Laboratory went from controls between VLANs to controls within the same VLAN.
• Static firewall policies become dynamic. Palo Alto Networks firewalls use the tags and IP addresses Zero Networks discovers, which makes policy management simpler for administrators.

Speaker: Miguel Angel Amigo, CISO, Reference Laboratory

[Translated from Spanish]

Why does Zero Networks remind this CISO of Palo Alto Networks in 2007?

Miguel Angel Amigo: We were one of the first customers in Spain to implement Palo Alto, because we saw, and were surprised by, the ability to see the applications, where the users were connecting, how it organized it for you, and all of that. And now, seeing Zero Networks, it was the same feelings I experienced in 2007, when we implemented that Layer 7 solution.

The level of innovation I’ve seen in Zero Networks is the same feeling of innovation that Palo Alto gave me 15 years ago, at the time.

How does Zero Networks automate segmentation policies?

Miguel Angel Amigo: I would highlight the simplicity of the product, both in the implementation and in the policies it generates for you. Uh, it’s like they say in my department, it’s black magic. They don’t know how it can see which ones are service accounts, when all the accounts are generic user accounts, and how, between the machines, when it’s an Active Directory, it creates some, some policies for you; when it’s an email server, it creates one for you; when it’s a database, it creates another. That is, it has surprised us. It’s a modification that you would have to make manually, but it, seeing the traffic, and that it’s safe traffic, generates it automatically.

There’s also another, another thing: we receive alerts from Zero Networks about things it has detected, and it improves the policy. That is, it modifies the policy so they can be applied. That is, a policy, a policy that it already created previously, it sees that another machine on the network has the same traffic, and it applies it to the same policy.

How does Zero Networks protect privileged accounts with MFA?

Miguel Angel Amigo: Recently we, uh, applied the one for privileged user accounts. We put all our administrator accounts in the group, and now it has created policies so that any process that runs locally or across the network, or any process that needs a privileged account, is going to validate with us with an MFA. So we know that process was run by the administrator and no other account that isn’t external.

That is, before, we had what was, that is, security between VLANs, and now what we have is security within the same VLAN. Now the only inconvenience is for the users who are on the team, but of course, they’re more secure.

How do Zero Networks and Palo Alto Networks work together?

Miguel Angel Amigo: I think we’ll see a great solution between Zero Networks and Palo Alto, because policies that the Palo Alto firewall has as static, by taking advantage of the intelligence of the tags that Zero Networks has created, or the IPs it has detected on the same network, we can have dynamic policies within the same Palo Alto firewall. That means an administrator’s management will be simpler.