Risky Business Interview: Aaron Steinke of La Trobe Financial Talks About Zero Networks

Summary

La Trobe Financial, a Melbourne financial services firm, rolled out Zero Networks to stop lateral movement across a network that’s been evolving since the ’80s, after a few failed attempts with other tools. On Risky Business, host Patrick Gray talks with La Trobe’s Head of Infrastructure, Aaron Steinke, about automated learning that actually works, bolting identity-aware access and MFA onto legacy protocols, and pairing Zero Networks Connect with Segment so remote and in-office users get the same security.

Speakers: Patrick Gray, Host, Risky Business · Aaron Steinke, Head of Infrastructure, La Trobe Financial

Key takeaways

• It does what’s on the tin. La Trobe’s earlier microsegmentation attempts stalled on huge, manually maintained rule bases. Zero Networks’ automated learning mapped real traffic, down to the odd port that only gets used once a month.
• Legacy is no longer a blocker. On a network evolving since the ’80s, Zero Networks retrofits identity-aware access onto legacy apps and protocols that couldn’t otherwise be fixed cost-effectively. Every connection is tied to a real directory user and fed into Splunk.
• MFA happens before the firewall opens. SSH and RDP now require MFA before the port opens, without the latency and bugs of tools that sit inline with authentication. It also answered a recurring audit question about missing MFA.
• It’s built for small teams. Default deny with straightforward exceptions keeps it manageable without a big-bank headcount. Aaron compares it to what Airlock does for files.
• Remote and office users get the same security. Pairing Zero Networks Connect with Segment ended the gap where VPN users got more network access than in-office users. It works with legacy SSH and RPC apps that ZTNA, SASE, and enterprise browsers didn’t handle well.

Patrick Gray: Hi everyone, and welcome to Risky Business. My name’s Patrick Gray. We’ve got a great week of news to get through with Adam Boileau in just a moment, and then we’ll be hearing from this week’s sponsor. And this week’s show is brought to you by Zero Networks, who make a really cool microsegmentation product. And those words don’t normally belong together, which is a really cool microsegmentation product. But Zero Networks basically automates a lot of microsegmenting your network. And joining us this week instead of someone from Zero Networks, they actually had me speak with a customer, Aaron Steinke, from La Trobe Financial in Melbourne. And yeah, he talked through why they rolled out Zero Networks and what that experience was like. The upshot is, Aaron says it actually does what’s on the tin, which even surprised him. That was actually a really fun interview, so do stick around for that one.

What does Zero Networks do?

Patrick Gray: This week’s show is brought to you by Zero Networks, who make a really, really cool microsegmentation product, which orchestrates existing gear within your network to deliver microsegmentation. And the way it deploys is actually pretty cool because you throw it out there, and it learns which machines talk to which machines, and then you can sort of put it in an enforcement mode, and bang, you have microsegmentation. Now, a lot of products have promised to do this sort of thing over the years, and they don’t really — like the experience doesn’t live up to the marketing claims. So this week, instead of having someone from Zero Networks actually on the show to talk about their product, instead they suggested I speak with one of their users. Aaron Steinke works for La Trobe Financial, which is a financial services firm based in Melbourne, Australia. And yeah, he rolled out Zero Networks and is a very happy customer. Obviously, a vendor is not going to give you one of their unhappy customers. But I will say, I spoke with Aaron, I don’t know, for a good half an hour after we recorded this interview. This is a guy who knows his stuff. Absolutely 100% knows his stuff. And I found this interview interesting because he really does mount a compelling case that what Zero Networks claims it can do is actually what it can do, which is more than you can say about a bunch of vendors. Anyway, here’s Aaron Steinke from La Trobe Financial in Melbourne, talking about his experience in installing and spinning up Zero Networks’ network microsegmentation product. Enjoy.

Why is microsegmentation so hard for financial institutions?

Aaron Steinke: We’re a financial institution. We are very paranoid. That’s the nature of working in finance. And getting those controls over lateral movement in our network is really essential, and it’s a hard thing to do. And we knew it was a hard thing to do before we committed to it, but like all the most effective controls, there’s a fair bit of work to get it done. We have actually found that with Zero Networks’ product, there’s actually a lot less hard work than there is in some of the alternatives that we have played with in the past. This isn’t our first rodeo, and there’s been a few failed attempts in the past to get to a proper segmented and microsegmented network, with varying degrees of success.

Patrick Gray: Yeah. So that’s the interesting part, right? And I think that’s one of the reasons it’s not a commonly done thing as yet, right? Is it is hard to do. It’s been hard traditionally to do it.

Why did earlier microsegmentation attempts fail?

Patrick Gray: Well, what were the sticking points with other attempts that you’d had at this with different tooling?

Aaron Steinke: Well, with some of the other tools, you’ve got a huge complex rule base that you end up having to maintain manually. There’s a lot of work and a lot of feeding and watering. And even when it goes to new product rollout, where the documentation’s never what it should be. You’re putting in a system created by someone else and there’s some weird little port that only gets used once a month that pops up. The tooling with Zero Networks has really made that whole automated learning process work really well, which it’s another one of those features that everyone promises. And it — it really —

Patrick Gray: I was actually about to say, so like what you’re saying is that this time it’s not all lies, right? It’s accurate. Because everybody’s like, “You just drop it in and automatically does everything,” and you know.

Aaron Steinke: Yeah. And that’s where the rubber hits the road. It really has done what it said on the sticker.

What should you prepare for when deploying Zero Networks?

Patrick Gray: Yeah. Well, that’s good. So look, it can’t have all been 100% smooth sailing, right? I’m guessing there’s still a few corners to round off. If someone’s thinking about doing this, what should they prepare themselves for?

Aaron Steinke: There’s a little bit of trial and error in it, as you would expect. So here at La Trobe, we have a network that has been chugging away and evolving for... since the ’80s. There’s some weird little hollows of legacy horror shows in there, like there are —

Patrick Gray: Yeah.

Aaron Steinke: — in most places. A few of the headaches we had were things where people had, in the past, tried some odd little tricks with group policies. And I think this is where Zero Networks really shines, is that a lot of those problematic bits and pieces that we have tried in the past that were really complex became a lot simpler. And we have the things that require like agents is where we’ve had a long struggle in the past. And I’ve got to admit, too, that I was a little bit cynical when we first started talking to Peter [CHECK: confirm who Peter is and add a bracket, e.g., [Name, Title, Zero Networks]] about how the whole product runs on WinRM, which —

Patrick Gray: Yeah.

Aaron Steinke: — has also been a bit of a horror show for those of us who have been around for a while. I was cynical that it could actually perform and do its job in a timely manner. And they’ve clearly done a fair bit of work in the background and got that working, and got that working quite reliably, and it’s scaling pretty well. We haven’t had any issues with latency, at least not yet.

Can microsegmentation work on legacy, on-prem networks?

Patrick Gray: And it’s funny, you were talking about the nature of your network — what came across was like, yeah, there were a few sticky parts, but that was our fault, not theirs, kind of thing.

Aaron Steinke: And it is. And that’s actually a problem that I’ve seen in the past too, with other microseg products. They work great if you’re in a cloud-native environment, if everything is modern and shiny and new. And we, down here in the real world, where you and Adam like to rubbish us a bit, we have to deal with some pretty horrible old school protocols that don’t play nice, that aren’t predictable. And it means things like the zero trust approach to a lot of our software’s been really difficult. With Zero Networks and the way that it is identity aware at the point where you’re making your network connection, has let us retrofit a lot of those smarts to products that really haven’t lent themselves to it, that would’ve needed an inordinate amount of development time in their authentication mechanisms to get us to that sort of continuous identity draw. [CHECK: “draw” may be a caption error; confirm against the audio.]

Patrick Gray: Yeah. So we’re talking essentially bolting on at least some sort of identity aware access control onto on-prem legacy crap, horror show, awful stuff.

Aaron Steinke: Yeah.

Patrick Gray: That you can’t do it any other way.

Aaron Steinke: Yep. Or —

Patrick Gray: Yeah.

Aaron Steinke: — you could always do it another way, but it’s not necessarily cost effective.

Patrick Gray: Yeah.

Aaron Steinke: And bear in mind too, that some of these products are things we already have an axe hanging over their head, but it’s a multi-year process and hundreds of thousands, if not millions of dollars to get rid of them. We have to do something to get us over that gap. And that’s been a real godsend.

What does user attribution add?

Patrick Gray: Well, yeah, and I’d imagine too. So I work with a company that does something similar, but for external resources, not so much internal resources. And one thing that’s really interesting that we keep hearing from people around that one, and I imagine it’s the same for the internal use case, is the user attribution you get on who’s doing what on the network, like actually tied down to a user who actually exists in a directory somewhere who you can identify. I imagine that’s something you’re probably doing something with that?

Aaron Steinke: Yep. Our security guys love it. The feed that’s going into Splunk is making their eyes water, in a good way. They —

Patrick Gray: Yes. They are tearing up misty tears of joy.

How does MFA before the firewall opens work?

Aaron Steinke: We’ve even had a bit of a tinker with those high-risk protocols, the SSH into boxes, RDPs into things. It’s also letting us put in an MFA step before the firewall even gets opened, which is really nice. That’s —

Patrick Gray: Yeah.

Aaron Steinke: — historically been incredibly hard. We’ve had a few shots at that with other products that don’t necessarily work in that sort of segmentation model, but where they intersect the authentication mechanism, they tend to add latency, cause bugs, cause errors, cause headaches. Because this is happening before it triggers, we’re finding it’s a lot more successful and less intrusive.

What tangible wins has La Trobe Financial seen?

Patrick Gray: Yep. So, have you racked up any tangible wins since you’ve started doing this? Is there something you can point to and say, “Well, that saved our bacon”?

Aaron Steinke: One of our biggest wins is a common audit question every time the auditors come through, which is every five and a half minutes in a financial institution. We’re getting asked why we’re not doing MFA on certain products and protocols, and it’s given us a way of implementing that. That’s probably the biggest use case we didn’t really expect to be solving, that it’s really got us a nice little green tick for.

Patrick Gray: Yeah. It’s funny actually, Benny [Lakunishok], who’s the founder of Zero Networks, when I’ve had him on the show previously and asked him what’s driving growth, because I know they’re growing. And he’s like, “Man, the amount of compliance stuff that people are just like, ‘Oh my God. I can just get this in and it solves that problem.’” The security benefit’s like a nice benefit to the compliance side, which is not the way it should be, but hey, I don’t know, maybe it’s a good news story about compliance.

Aaron Steinke: I think it is. And the other thing it has solved for us is, we don’t have a huge team here. We’re not National Combank. [CHECK: likely a caption error, e.g., “NAB” or “CommBank.” Confirm against the audio.] We need something that’s reasonably easy and straightforward to manage so that we can get the best out of our people, and that it really is quite straightforward to add exceptions where we need them to respond, to do all those things. I like to think that it’s doing a bit for our network segmentation, what the likes of Airlock do on —

Patrick Gray: Yeah. Yeah. For files, right?

Aaron Steinke: Yeah. It’s similar thinking.

How does Zero Networks Connect replace a VPN for legacy apps?

Patrick Gray: It’s similar thinking, right? Which is default deny and open up only where you need to. So, yeah. Now, we were chatting before we got recording, and I actually asked, “Did you hear of Zero Networks from the podcast?” Because you are apparently a long-term listener who’s listened when I used to put music at the end of the shows and whatnot. And you said, yeah, you remember us talking about their remote access product, right? So this is, for people who aren’t familiar, they’ve got their microsegmentation thing. But Zero Networks developed a remote access solution for people who are wanting to throw away their horrible VPNs and get something in place that was less risky. What they’ve done is they’ve got a VPN where all ports are closed until you MFA, till you go through your IDP. It opens up the port, and then you can go through, and it’s sort of IP restricted and just a lot safer. This is good thinking, but that’s where you actually started with them, right? And what’s funny is, I know from talking to people at Zero Networks that that product has been way more successful than I think they’ve realized it would be. Which in retrospect, I guess, kind of makes sense. But you wanted to talk about that too, because you’re a big proponent of it.

Aaron Steinke: I’m a big proponent, not just because the whole ecosystem of VPN solutions sucks. But also because when we look at more modern approaches to VPNs, the zero trust network access, the SASE solutions, the enterprise browsers, they’re pretty useless to us. We have a whole lot of legacy protocols and legacy applications, and things where we have users who directly interact with SSH, thick clients that use RPC all over the place. Those sorts of things which the more modern approaches don’t really work that well with. We’ve tried enough of them to have zero confidence in them actually being a fit for purpose solution. So we’ve sort of stuck with a more traditional VPN type of approach. And what we had been going down the road of was sort of segmenting our users as they VPN in so that we could get some sort of classification and firewall in there, and it, again, went back to a really d—

Patrick Gray: Well, yeah, that gets complicated real quick, right?

Aaron Steinke: And even trying to get the sort of same class of service when you are on-prem versus remote has been a real nightmare. Whereas once you put the two together, the Connect and the Segment product, you end up with that. The user gets the same user experience whether they are remote or in the office, and we get that same level of security. Whereas historically, we’ve found that you often end up in a scenario where people have more network access when they’re on the VPN because you can’t categorize them and classify them well enough.

Patrick Gray: Yeah.

Aaron Steinke: So that’s really, I think, hugely improved with a typical workforce that we have, where people are regularly working remotely these days, which they weren’t pre-COVID. It’s given us a much more robust solution to how we treat those remote workers without having to completely throw out our entire stack, which, as I said earlier, is not a cost-effective solution, at least not to happen in three months’ time.

Patrick Gray: All right. Well, Aaron Steinke, thank you so much for joining us on Risky Business to sing the praises of one of our sponsors, which is Zero Networks, which is, yeah, certainly a company we think makes cool stuff. Great to meet you, and fantastic to chat to you.

Aaron Steinke: Cheers. Thank you.

Patrick Gray: That was Aaron Steinke there talking about his experience of being a Zero Networks user. And again, Zero Networks, one of those companies that’s taken an old concept and actually made it workable, much like Airlock Digital. I did find it funny, actually, in that interview when Aaron made an Airlock reference, because that implies that he’s an Airlock user. And I can just imagine being a very sad pen tester if you landed on a network that is running Zero Networks and Airlock Digital at the same time. That’s a bad day at the office. But yeah, that is it for this week’s show. I do hope you enjoyed it. I’ll be back tomorrow in Seriously Risky Business. But until then, I’ve been Patrick Gray. Thanks for listening.

Key takeaways

• It does what’s on the tin. La Trobe’s earlier microsegmentation attempts stalled on huge, manually maintained rule bases. Zero Networks’ automated learning mapped real traffic, down to the odd port that only gets used once a month.
• Legacy is no longer a blocker. On a network evolving since the ’80s, Zero Networks retrofits identity-aware access onto legacy apps and protocols that couldn’t otherwise be fixed cost-effectively. Every connection is tied to a real directory user and fed into Splunk.
• MFA happens before the firewall opens. SSH and RDP now require MFA before the port opens, without the latency and bugs of tools that sit inline with authentication. It also answered a recurring audit question about missing MFA.
• It’s built for small teams. Default deny with straightforward exceptions keeps it manageable without a big-bank headcount. Aaron compares it to what Airlock does for files.
• Remote and office users get the same security. Pairing Zero Networks Connect with Segment ended the gap where VPN users got more network access than in-office users. It works with legacy SSH and RPC apps that ZTNA, SASE, and enterprise browsers didn’t handle well.