Why Zero Networks: Automated Microsegmentation in 7 Minutes

Summary

Attackers spread through networks because ports are open and accounts are over-permissive, so once one machine is compromised, everything is. Zero Networks makes microsegmentation achievable by automating rule creation with a learning engine, deploying without agents, and keeping privileged ports closed until a user completes just-in-time MFA. In this seven-minute video, Nicholas DiCola, VP of Customers, explains the approach and shares customer results, including Evercore closing its lateral-movement pen test findings.

Key takeaways

• Attackers usually move laterally over privileged ports that are already open. In DiCola’s incident response work at Microsoft, attackers typically reached domain admin in under 72 hours.
• Microsegmentation projects often stall because rules are built by hand and deployments drag on.
• Zero Networks automates rule creation with a learning engine and deploys agentlessly, using native host and network controls.
• Just-in-time MFA keeps privileged ports closed until a user authenticates, so a compromised machine can’t reach others.
• Use cases include stopping ransomware, passing pen tests, meeting cyber insurance MFA requirements, and segmenting assets for compliance frameworks such as PCI DSS.

[00:01] Nicholas DiCola, VP of Customers, Zero Networks: Hey, welcome. Today we’re going to talk about leaving hackers stranded and penniless with Zero Networks. I mean, who wouldn’t want to leave an attacker stranded and penniless? It’s ultimately the goal of all of us here working in cybersecurity. But good to meet you. I’m Nicholas DiCola, the Security Jedi and VP of Customers here at Zero Networks. So let’s dive in and talk about this.

[00:24] So I always start out with this slide. It’s one of my favorite slides, and I ask people, “Hey, what does this look like to you?” I typically get responses like, “Oh, somebody on their vacation day,” which we don’t get very often in cybersecurity. I had one person tell me it looks like a scene from the new Gladiator movie. That’s entirely possible as well. Great movie, by the way. But I say no, this is what an attacker is like when they’re inside your network.

Why do attackers move so easily through networks?

[00:48] So why are they running so freely in your network? It’s because networks are too open and accounts are too permissive. Basically, when an attacker gets in, they can spread laterally very easily. So we have a saying: one compromised equals all compromised. It could be a drive-by website, it could be a phishing attack. It doesn’t really matter. Once the attacker is in on the first machine, if you look at something like the MITRE playbook, the attacker follows the same attack patterns to move laterally throughout the network. There are multiple things they can do, but most of the time they just use privileged ports that are already open in the network to move to the next machine, and then the next machine. When I was at Microsoft and we did some IR work, we typically saw an attacker had domain admin privileges in less than 72 hours. Very, very common. So it’s very easy for them to spread laterally throughout the network.

[01:39] So, okay, we know that attackers can do that, and we continue to see that companies are spending more and more on cybersecurity. Data breaches continue to rise; they’re not going down. And the average cost of a data breach continues to go up, according to various sources here. This is not good. We’re spending more money, and we’re having more incidents. It’s not going down. This is a problem that we really need to solve.

Why do microsegmentation projects fail?

[02:03] So we know microsegmentation will help bring this down, because we’re closing down the networks and stopping the attackers from spreading. When we talk to customers about their segmentation maturity, most are somewhere on these various levels. Most would like to be down in the advanced or holistic level, because they know the security posture gains they would get would be through the roof. It would go up, even though the arrow’s pointing down. It’s okay. But the historical effort and cost to get to holistic segmentation is extremely high, right?

[02:32] So when we ask customers, “Okay, it’s high. Why would you not go there, if you know the gains are very high from a security posture perspective?” we hear lots of challenges: it’s a never-ending deployment, we’re going to get low ROI. So most folks don’t even invest in trying microsegmentation, and some that do don’t fully implement, right? So it’s a small number. Even Gartner says the failure rate of network segmentation projects is high. Most projects last longer than the average tenure of a CISO. That means a CISO will start that project, leave, and move on to his next effort, project, or job, and not even finish that project, because it just takes too long.

How does Zero Networks make microsegmentation achievable?

[03:10] And that was all true until Zero Networks came along. What we did is reduce the effort and cost associated with microsegmentation, and we now make it something that’s actually achievable for customers. First, we fully automated segmentation by having a learning engine. It’s very deterministic: it learns the environment and automates building the rules so you don’t have to. We also deploy in a very easy manner, which is agentless, using native controls available on the hosts or at the network level to control access to those machines. And more importantly, we knew from an attacker’s perspective, looking at the MITRE ATT&CK framework, that once an attacker’s in, they want that privileged access. So we built a just-in-time, MFA-based capability for privileged access. Now those privileged ports are closed all the time and only opened after the user MFAs.

What happens when an attacker lands in a segmented network?

[04:03] So we have a great quote from one of our customers here, who said, hey, our microsegmentation project was planned to be two years, and we’ve now shortened that down to six months with Zero Networks, because we can actually achieve that very quickly with the capabilities Zero Networks provides. So now they’re freeing up resources to go focus on their next cybersecurity project or zero trust project in their cybersecurity journey, because we allow them to do that with Zero Networks.

[04:30] So now, instead of one compromised equals all compromised, when you have Zero Networks, it’s one compromised equals none compromised. When an attacker gets in and starts poking around, they can’t find anything open on the network. They’re not able to move laterally. So what do they do? They get up and leave, and they go to the customer that doesn’t have Zero Networks or doesn’t have microsegmentation in the environment. They ultimately start there, because they can easily move laterally through that environment.

What problems does microsegmentation solve?

[04:58] So microsegmentation is ultimately the solution that solves the problem, but it solves many different problems across environments and businesses. The main goal is stopping ransomware and stopping attackers from spreading. But you can also equate that to passing a pen test, right? That’s ultimately an attacker getting into the environment and spreading. We’ve had some customers come and say, hey, insurance is now requiring MFA for all of our admin operations. Because we do that just-in-time MFA, we can solve those types of capabilities, as well as compliance capabilities. We hear customers say, hey, we know we have to segment off these assets because they’re part of some compliance framework like PCI DSS, and we need to be able to report on that. And we easily do that in Zero Networks to help customers solve these challenges. So these might be a few challenges that you have that we hope we can solve for you as well.

What results have customers seen?

[05:46] In terms of our customers, you can see multiple customers here, and you can check out our website. We have lots of customers, but most importantly, customers love what we do, because we took this super hard problem and made it very easy for them to solve in their environment. So we have very high Gartner Peer Insights ratings and one of the highest CSAT scores I’ve ever seen.

[06:04] Just an example from one of our existing customers, Evercore: one of their big challenges was they knew that if an attacker got in, they could easily spread through the environment, as proven by their pen tests. Once they segmented with Zero Networks, they had zero of those pen test findings. They’ve all been closed down, and the attacker couldn’t move throughout their environment. And most importantly, they did this without professional services or having to add headcount. Again, we make it very easy for the customer. They used less than one FTE to manage this across their environment, and it’s very easy for them to get segmented and solve this problem.

[06:40] So thank you for taking the time to hear me out, and I hope you have a great day. Take care.