How Great Clips Shrinks Its Attack Surface with Zero Networks

Summary

Great Clips, a hair salon franchisor with over 4,500 locations, used Zero Networks to close the access gaps flagged in its annual vulnerability scans and risk assessments. Tim Bartram, IT Operations Manager, explains how the team locked down servers and laptops, moved internal access control away from internal firewalls and switching, and used network-layer MFA to open ports only when needed. Deployment took about an hour, and Zero Networks Secure Remote Access hid the company’s remote access portal from scanners and attackers.

Key takeaways

• Before Zero Networks, risk assessments repeatedly asked Great Clips to restrict access to specific portals and applications, and it couldn’t. Now it can.
• Great Clips controls server-to-server, endpoint-to-server, and user-to-server access through Zero Networks instead of internal firewalls and switching.
• Tim says deployment took about an hour, and the product runs largely “fire-and-forget” once configured.
• Network-layer MFA, pushed through Duo, keeps ports closed until an approved user opens them.
• With Zero Networks Secure Remote Access, the remote access portal isn’t exposed, so scanners and attackers can’t find or target it.

What changed for Great Clips after Zero Networks?

[00:00] Tim Bartram, IT Operations Manager, Great Clips: Before Zero Networks, we had gaps, we had openings, we had places that were at risk. And after Zero Networks, we were able to lock down endpoints, both on the servers and on the laptops. Our attack surface has decreased incredibly.

[00:23] My name is Tim Bartram, IT Operations Manager of Great Clips. Great Clips is the largest franchisor of hair salons in the country. We have over 4,500 salons, and we’re expanding every day. Every year, we go through these vulnerability scans and these risk assessments, and one of the biggest things they ask us is, “Hey, can you restrict access to this portal? Can you restrict access to this application?” And the answer was no. Now the answer is yes.

[00:56] One day I was at Black Hat in Las Vegas. I was walking through all of the booths, and I saw this big blue sign, Zero Networks, and I made a beeline directly to that booth. And it was almost like it was meant to be. It was something that I had been looking for for years, a decade, right?

How did Zero Networks replace internal firewall controls?

[01:19] Moving to Zero Networks and going down the zero trust path, we’ve been able to remove the internal firewall and the switching from that equation and completely control all of that through Zero Networks. Whether it’s server to server, endpoint to server, or a user somewhere to server, a lot of those problems that we had, that dinged us and lowered our score on all those risk assessments, have gone away.

How easy was deployment, and how does MFA work day to day?

[01:52] It’s easy, it’s intuitive, it really makes sense. The deployment was extremely simple. I want to say it was an hour, if that. It’s one of those tools where it’s almost fire-and-forget once you get it configured. My favorite feature is the multifactor. I love being able to control when a port is open and when a port is closed with just the touch of my button on Duo. When it pushes, it just makes everything a no-brainer when it comes to managing the network.

How did Zero Networks secure remote access?

[02:28] The VPN Connect solution was kind of a game changer for us as well, because that was another thing we were getting dinged on in our scans and our risk scans. With our other product, our VPN product, the portal is always open, and it’s not able to be protected through multifactor. With Zero, the portal to the VPN isn’t wide open so people can see it. Scanners can’t hit it. Attackers can’t target it. They don’t even know it exists. So, pretty amazing.