Battling Ransomware with Microsegmentation: Safeguarding Financial Institutions

Summary

Financial services firms face advanced persistent threats, supply chain attacks through third-party partners, and prolific ransomware, and attackers increasingly log in with stolen credentials rather than breaking in. In this webinar, Zero Networks Field CTO Albert Estevez Polo and Tony Koziana explain why prevention alone eventually fails, and how automated, agentless microsegmentation contains attackers once they’re inside. Zero Networks automatically classifies assets and generates policies, closes privileged ports like RDP until users pass network-layer MFA, locks down Active Directory with the RPC Firewall, and restricts how service accounts can log on, so organizations can fully segment in months rather than years.

Key takeaways

• Financial services has among the highest breach volumes and breach costs of any industry, and breaches keep rising even as security budgets grow.
• Attackers increasingly use AI-generated phishing to steal credentials and log in, then move laterally unnoticed, so organizations must plan for what happens after the perimeter is breached.
• Legacy microsegmentation projects often stall because they require agents, depend on manual asset classification and policy creation, and struggle with unsupported legacy systems.
• Zero Networks is agentless, automatically classifies assets and generates policies after a 30-day learning period, and keeps privileged ports closed until MFA, typically for a policy-defined window such as one, four, or 12 hours.
• The RPC Firewall locks Active Directory down to the RPC methods it actually uses, and identity segmentation restricts each service account to the logon types and assets it needs.
• Evercore closed all six major findings from its pen test with about half of a full-time employee’s effort, and customers of that size can be fully segmented in three to six months.

This webinar was recorded in early 2025. Statistics cited reflect that time.

[00:00] Moderator: Welcome, and thanks for joining us for this exclusive webinar for financial services on battling ransomware with microsegmentation. We’re citing multiple data sources today, and the primary one is a recent survey we conducted through VIB, which includes a lot of interesting findings about microsegmentation and ransomware, plus some data specific to financial services. Albert and Tony, would you like to introduce yourselves and kick us off?

[01:03] Albert Estevez Polo, Field CTO, Zero Networks: Sure, thank you. I’m Albert Estevez Polo, field CTO for Zero Networks. I have 25 years of experience in cybersecurity. Most recently, I spent 14 years at Palo Alto Networks, working on everything from migrating security policies to the Strata product management team, on projects like post-quantum cryptography, passwordless authentication, and microsegmentation.

[01:34] Tony Koziana, Zero Networks: And I’m Tony Koziana. I’ve been with Zero Networks since October. I started my career on the federal side, at the Department of Defense in the Pentagon and then at the FBI, and moved to the commercial side after helping federal agencies for a while, working at a cyber recovery company. I was getting pulled in after breaches occurred and seeing the damage they did. Being on the inside, under NDA, and seeing what actually happened in these breaches opened my eyes to the fact that customer networks today are a little too open, and accounts are a little too permissive. So today we’re going to talk about battling ransomware with microsegmentation.

What cyber risks are financial services firms facing?

[02:34] Tony Koziana: Albert, from your perspective, specifically in financial services, what risks are we seeing that are causing this?

[02:42] Albert Estevez Polo: We’ve had a lot of conversations with many customers and have tracked the industry for many years. There are actors, even countries, behind advanced persistent threats targeting companies, and those are among the most dangerous attacks we see. But there are many others, like supply chain attacks. Financial institutions rely on many third-party partners that manage services for them, and if one of those partners has a security incident, attackers may use the partner’s credentials or access to break into its customers. Ransomware is very prolific; we all hear how many companies have been hit and how much they’ve paid, and that industry keeps growing. And what we’ve learned is that for every new problem, we bring in a new security solution, so financial institutions end up with a lot of different tools. But whatever is complex to manage is usually not secure.

Why aren’t breaches in financial services slowing down?

[04:07] Tony Koziana: I agree. When we look at this chart, financial services has the second-highest number of breaches, and it increased from 2023 to 2024. Financial services also has the second-highest cost per breach, and I’m pretty sure that number doesn’t even include what happens later, like the lawsuits that can keep coming for years after the initial breach. At my last company, I made it a habit every week to search for ransomware news to educate my team and myself, and almost every week there were one to three new breaches making the national news. That’s kind of crazy.

[04:39] Albert Estevez Polo: It is. And every year, companies increase their security budgets, yet attacks aren’t decreasing at all.

How are attackers getting into financial networks?

[05:39] Tony Koziana: Maybe we can talk a little about how this is happening, so people realize what they need to look for.

[06:10] Albert Estevez Polo: What we’re seeing in the field is that attackers sometimes still try to break in by finding vulnerabilities, but they’re putting more effort into logging in instead. AI is a good example: it’s helping phishing attacks succeed, because now it’s easy for anyone to generate an email that looks legitimate, and the weakest link in the security chain is always the human, the user. Attackers can even build a website that looks like your corporate login page, where you enter your credentials. It’s easier to grab those credentials and use them to log into the network, and then nobody notices they’re there. And once you’re logged into a network, you can usually move around without being noticed.

[07:10] Tony Koziana: So we spend a lot of time on the perimeter trying to stop attackers. That’s still great to do, as part of defense in depth, but we have to prepare for what happens once they breach the walls and get inside.

Why is it time to shift the security mindset?

[07:41] Albert Estevez Polo: Exactly. It’s time to shift the mindset. For many years, the industry focused on helping customers prevent attacks. But the reality is that no matter what, at some point someone will find a hole to dig into and break into your network, because they trick users into giving up credentials, or whatever the method. If your security posture relies only on prevention, at some point it will fail.

[08:12] Tony Koziana: You mentioned attackers are logging in, and I think we have two audiences here today. There’s the security crowd, but the infrastructure team has to be aware of this too. When I talk to infrastructure teams, I often hear, “As long as they don’t get my admin credentials, our environment’s in a good spot. They can’t do anything without my creds.”

[08:42] Albert Estevez Polo: But the reality is that some ports need to be open. If your administrators need to log in over RDP, for instance, the port needs to be open for them. So who do you trust? Do you write policies that trust only certain IPs to connect to RDP, or do you rely on the port not having any vulnerabilities, and put all your security in identity? You just mentioned that someone without your admin credentials can’t log in to that machine. But what happens if there’s a vulnerability in RDP? Attackers will exploit the vulnerability without using credentials and break into the machine. We need to assume that will happen at some point, and make our networks resilient to those attacks by changing the rules of security to apply a true zero trust approach, where we don’t trust anybody.

[09:43] Albert Estevez Polo: That requires a big change in the industry, because these changes can’t be made by hand anymore. Automation is key. And something we do really well at Zero Networks is changing the paradigm from static security policies to dynamic security policies based on MFA. Regulations like DORA are also pushing organizations in this direction.

[10:14] Tony Koziana: Some organizations are trying but haven’t figured out how to get there, and honestly, some applications just don’t support MFA, which is where we help as well. But now that it’s being regulated, you don’t really have the luxury of saying, “We just can’t do it.” You’re going to be pushed to meet these financial compliance requirements.

[10:44] Albert Estevez Polo: Yes, and to me, that’s a game changer. If you can restrict access to the port itself, and the port isn’t open, it can’t be hacked. That’s the mindset.

[10:54] Tony Koziana: That’s hard for security and operations teams. We’ve discussed this before: the security team wants to close these ports because they know they’re insecure, but the operations team still has to do its job, and you can’t damage their ability to keep the business running. That’s the hard juggle in security: staying secure while letting the business keep moving, and ideally helping push the business forward rather than slowing it down.

[11:15] Albert Estevez Polo: Totally. So shifting the mindset is key. We need to start thinking of access to certain ports as conditional on MFA. That’s a game changer.

Why haven’t more financial firms adopted microsegmentation?

[11:46] Tony Koziana: As we move forward, I think financial services leaders agree that microsegmentation is something we need to do. On this slide, you can see that most respondents consider it at least somewhat important, and only a few said microsegmenting their environment isn’t very important at all. But many still haven’t started this journey. Albert, why isn’t it being adopted more, given that it can help?

[12:16] Albert Estevez Polo: There are many factors, but for many years, the only tools available made things really complicated. When I talk with customers about microsegmentation, the first feedback I get is, “This is going to be hard. It will take an army of people just to understand my network, who’s talking to whom, and then generate the security policies to protect all of it. My security program isn’t mature enough.” The common belief is that you first need a cleanly segmented network, and then maybe at some point you tackle microsegmentation as a huge project. That’s some of the most common feedback I get. And then there are legacy applications: all those machines that keep the business running but are out of support, use really weak protocols, and are easy to exploit. How will you manage them? They may not even be in your Active Directory.

[13:19] Tony Koziana: Right, and there’s turnover of the people who put those systems in place, too. Gartner said legacy microsegmentation implementations take longer than the tenure of the average CISO, and the CISO isn’t even the one doing the work. Think about how many people may have left who put those applications in place and knew which ports were required and what would break if you locked it down. It’s funny: everybody thinks we should do this, and only 4% said you maybe don’t need to microsegment, but zero respondents said they had no concerns about microsegmenting their environment, based on what they know about microsegmentation today.

How does Zero Networks make microsegmentation easier?

[14:20] Albert Estevez Polo: When you ask customers whether they’ve tried to tackle a microsegmentation project, the majority of those who say yes never finished it. They usually share two big reasons. The first is that the most common path to microsegmentation required deploying an agent for visibility and control of the endpoint, and that turned out to be one of the biggest issues for many customers. Deploying a new agent across your infrastructure isn’t easy, and it can cause incompatibility issues. So the first thing we decided at Zero Networks was that whatever we built had to be agentless and frictionless, so it’s easy to deploy. Instead of a project that takes years just to deploy agents, with us it’s a matter of minutes.

[15:23] Tony Koziana: And that’s not even thinking about day two. I remember, on the customer side, the pain of trying to get a DBA to let me reboot their box to update an agent. How do we run something that’s supposed to maintain our security if I can’t even do the reboots required to keep those agents up to date?

[15:54] Albert Estevez Polo: Sure. The other big pain we hear from customers is that most tools focus heavily on visibility. Customers tell us they were stuck on visibility. They thought that once they had visibility, implementing security would be easier, but the reality is that these tools focus on visibility rather than prevention. So customers end up having to validate their network themselves and classify every endpoint and asset, “This is a server, this is a DNS server, this is a SQL server, this is relevant to me or not,” and then generate the security policies. The customer owns the policy generation, so if something goes wrong, it’s the customer’s fault. For Zero Networks, it was super important that this process, which can take years, take days instead. We automatically classify every single asset for you, and we automatically generate the security policies for you, which is a game-changing solution. Zero agent deployment, automatic endpoint classification, and automatic policy generation: this is the way to go.

[17:28] Tony Koziana: A hundred percent. Anywhere you’re not automating leaves room for human error. When you’re microsegmenting potentially hundreds of thousands of servers, it takes just one missed port to take an application down. That’s why I think using that automation engine is so key.

How does network-layer MFA protect privileged ports?

[17:59] Albert Estevez Polo: Now let’s talk about privileged ports: the ports your network needs for administrative tasks. We’ve changed how we tackle them. We close the port at the host level and give access only to the person who needs it, at the specific moment they need it, by requiring MFA from the user who tries to connect to a privileged port. If a security policy allows your administrator to connect to a port like RDP, which we like to call the ransomware deployment protocol, that policy is created for you automatically, in real time, but only after the administrator passes MFA. That means the port is closed. Nobody can hack it, and nobody can try any username and password, because the port isn’t listening. It only opens after you pass MFA. That finally lets administrators block access to all those ports and make access conditional on MFA. To me, that’s a game changer.

[19:01] Tony Koziana: Game changer. We just resolved that age-old argument between security and operations we were talking about: letting them do their jobs while keeping security in place at the same time.

How does the RPC Firewall protect Active Directory?

[19:31] Albert Estevez Polo: Now imagine you’ve brought us into your infrastructure. We deploy our solution without agents, learn about everything for 30 days, and then we’re microsegmenting and you’re secure. But there’s still a piece that’s usually forgotten: Active Directory environments rely on RPC for a lot of tasks, and RPC is a well-known protocol with a lot of security vulnerabilities. So five years ago, Zero Networks created the first RPC firewall. It learns which RPC methods your infrastructure uses, and after 30 days, it locks down to those methods and removes all the others. If someone comes into your network for a pen test and finds RPC, attempts to abuse vulnerabilities in other methods won’t work. That closes the circle on zero trust and least-privilege access, even for ports that usually have to stay open to everybody.

[20:35] Tony Koziana: If we looked at a legacy microsegmentation approach other than Zero Networks, there would be a large gap here. Ports and protocols would be locked down to just what’s required, but for something like RPC to the domain controller, which requires that traffic to be wide open, they don’t have anything else to put in place. My team has mentioned several times that pen testers come up to our booth and say, “I ran into one of your customers who was running this RPC firewall, and I couldn’t even find the domain controllers.” Not to be mean to pen testers, but I love hearing that we’re making their job difficult.

How does identity segmentation stop lateral movement through service accounts?

[21:06] Tony Koziana: So we’ve got ports and protocols locked down, and RPC to your domain controllers locked down with the RPC Firewall. I’ve heard some people say that if you just get identity right, you can solve the problem. I think you need both. So what are we doing around identity?

[21:37] Albert Estevez Polo: To me, there are two dimensions in microsegmentation. One is how you connect: how you allow communication between assets, getting rid of static policies and moving to dynamic policies based on MFA. But if someone has access to an application like RDP, what happens with identity? Is this user allowed to log in to this machine? Is it even a user, or is it a service account? Let’s talk about service accounts. With the same agentless, frictionless approach we use for everything else, Zero Networks learns which of your accounts are service accounts: accounts that have a specific purpose in your network that you configured once.

[22:37] Albert Estevez Polo: As you and I discussed before, when you’re deploying a solution and run into a problem, the administrator will often say, “Okay, give this service account more rights,” just to confirm the problem isn’t permissions.

[23:08] Tony Koziana: We all know that. That vendor is only there to help for maybe the next day, and then they’re on a plane. If we don’t get it done, it doesn’t get done. And there’s nothing more permanent than something temporary: you make those changes and forget about them.

[23:40] Albert Estevez Polo: So what happens if someone guesses the password for one of those service accounts, or dumps memory and grabs service account credentials to move laterally over RDP, for instance? It will probably work, because the account is valid in your Active Directory, and if you haven’t done anything else, those accounts can be used to move laterally. So we learn how each service account is used in your infrastructure: is it only using network logons to do its job, or batch logons? After 30 days, we automatically build a logon policy in your Active Directory that says this service account can perform this type of logon from this asset, and nothing else. Service accounts can’t be used for interactive sessions or RDP. When you combine these microsegmentation dimensions, you get a solution robust enough to prevent almost any type of lateral movement in your infrastructure.

[24:40] Tony Koziana: That’s what we call holistic segmentation: not just typical network segmentation, but segmenting holistically. I didn’t realize how big identity would be for so many of the customers I’ve talked to. To my earlier point, personnel turn over. Whoever put those things in place, or wrote scripts calling service accounts that nobody else knew were running in the background, leaves the company, and now you’re left trying to secure it without breaking anything. It’s a real challenge for organizations.

How did Evercore pass its pen test with Zero Networks?

[25:11] Tony Koziana: That’s a good overview of the components we use to help protect your infrastructure. What about an actual use case, like Evercore, a customer we’ve worked with?

[25:45] Albert Estevez Polo: We helped Evercore improve its pen test results. Their pen test had found six really big findings, and the question was how Zero Networks could help them eliminate those issues and vulnerabilities. It took about half of a full-time employee’s effort, not an army of people trying to improve their security. We deployed our solution frictionlessly, without any agents, and after the learning period, everything was locked down. All the vulnerable ports the pen testers had found open to everybody were closed, because they didn’t need to be open to anybody, and some ports now require MFA before they open. So the pen testers couldn’t see any of the vulnerabilities or open ports they found before, and Evercore successfully passed all of the testing. For them, it was amazing.

[26:47] Tony Koziana: I love the speed at which we help people do this. We talked about how this can be a three- to five-year endeavor, or longer, but seeing customers of this size handle these challenges and become fully segmented in three to six months is awesome.

What business value does microsegmentation deliver?

[27:18] Tony Koziana: We’ve covered a lot, so let’s go back to how we help at a high level, for those of you who are less in the technical weeds and want the business value. First, reducing risk: passing pen tests and mitigating exposures, all of which ultimately stops ransomware attacks and cyber threats. Second, resource and cost efficiency, with fast time to value. You can buy this technology and actually use it within a couple of months. The learning phase is 30 days, and if operations is ready, you can start segmenting immediately. And third, enabling the business to accelerate change control, move quickly, and innovate faster without security concerns about what new tools are bringing into the environment.

[28:18] Albert Estevez Polo: I think you covered almost everything. The idea today was to give people a sense of what Zero Networks can do for them. This is game-changing, and there’s a lot to digest. But don’t just trust us. Give us a try and see for yourself.

How long do ports stay open after MFA, and what is the user experience?

[28:51] Moderator: Great content. We have a few questions. First: how long are ports open for MFA-approved users, and what’s the user experience like?

[29:21] Tony Koziana: How long they stay open depends on the policy. The MFA challenge is based on an MFA policy that targets certain users and certain traffic and prompts them. Once a port is opened, it stays open for whatever duration the policy specifies, whether that’s one hour, four hours, or 12 hours, and then we remove the rule and lock it back down. As for the user experience, we try not to do much to regular users; it’s mostly IT admins who see the MFA prompts. Maybe users get a prompt in the morning to connect to a share, and then they’re operational for the rest of the workday, and we shut it down after 12 hours or however long the policy says. The admins are who we’re worried about: the more rights you have, the more damage you can do, so if I’m a domain admin, I’ll probably be prompted for MFA more frequently. But in general, if you’re not an IT admin, you likely won’t even notice Zero Networks is in your environment.

Does Zero Networks work in hybrid and multicloud environments?

[30:23] Moderator: Next question: how would this work in a hybrid, multicloud infrastructure?

[30:53] Albert Estevez Polo: It works the same way. We have what we call a segmentation server, which can be deployed on premises or in the cloud; it doesn’t matter. We correlate all the information in the backend, so where assets are deployed isn’t really relevant, and customers get the same experience in hybrid and cloud environments.

What makes Zero Networks different from other microsegmentation vendors?

[31:15] Moderator: Last question, and it’s a competitive one, so I won’t name the competitor they mention: what makes Zero Networks stand out from the rest?

[31:23] Tony Koziana: For me, it’s the automation: being able to learn what your environment is doing and act on it, rather than just giving you visibility and saying, “Now go create these policies and tags yourself.” We automate it the whole way through. The second key thing is the MFA Albert talked about: dynamic rule changes that let me block privileged traffic that shouldn’t be open unless it’s needed, open it after an MFA challenge, and lock it back down afterward.

[31:54] Albert Estevez Polo: And time to deploy. Other solutions require multi-year projects with a lot of people and professional services just to get them working. Ours isn’t 100% plug-and-play, but you can think of it that way: you get value from deploying the solution in months, not years, and you don’t need an army of people to manage and set everything up, because we do most of the work for you automatically.

[32:24] Tony Koziana: It’s funny you mention that. When I look at some competitors’ professional services, I remember building my own estimate of what it would cost just for the materials, and then looking at what they charged, which was often double. With competitors that take this route, the professional services cost can actually exceed the license cost, because it’s such a manual lift.

[33:24] Moderator: Great stuff. Thank you so much, and thank you all for joining us.