Fast-Track and Future-Proof NIS2 Compliance

Moderator: Hello, everyone, and welcome to today's webinar, Fast Track and Future Proof NIS2 Compliance. For some quick housekeeping, please note that all attendees are in listen-only mode. We encourage you to interact with us through the Q&A or chat window on the right side of your screen. And we hope to have enough time at the end of today's presentation to answer any questions. But if for some reason we don't, we will, of course, get back to you offline after the event. So with that, I'll pass it over to our speakers and let them kick us off.

Chris Boehm: Hey, everyone. My name is Chris Boehm. I am the field CTO, uh, one of the two field CTO, uh, at Zero Networks. Um, and just a quick background about myself. I've, I've been in the cybersecurity industry for almost fifteen-plus years. Uh, it was just showing my age, I guess, a little bit. Um, I've been in, in the EDR space, the, uh, the full Microsoft security stack space, and I've been, uh, from small organizations to very large organizations, obviously, like Microsoft. Albert?

Albert Estevez: Yeah. I'm Albert Estevez. I am the other field CTO for, for the company. Um, my background is in cybersecurity as well. So twenty-five years working at the forefront of the, of the biggest, like, cybersecurity companies in the world. Like, I spent, like, fourteen years at Palo Alto Networks as an advanced product management, working in products like, uh, for quantum cryptography, and agentless, and microsegmentation.

What is NIS2, and why does it feel different?

Chris Boehm: We're gonna kinda dive right into it. Like, what is NIS2, and is, uh, how things are changing, and what, what, what it's supposed to be looking like. So usually this enforcement conversation, at least in my line of business, does happen, uh, on the European side. They are usually the cutting edge, or ahead of the curve, when it comes to certain enforcement policy and regulations, compared to, I would say, the United States, or other, even Asia, and so on and so forth, because they're just different regulations. Well, the enforcement is underway right now in, within Europe, and the accountability is moving closer right now. So that's why NIS2, we felt, was very relevant for our audience, is to talk about how is the shift occurring? And what are regulators gonna be looking for? So they're not gonna be just asking for, do, do you have this policy in place? They're gonna look for, are you actually demonstrating what we're looking for when it comes to NIS2 compliance? And even recently, with certain customers of ours, this is a primary focus point of why they're looking even at Zero Networks, as an example.

So why does NIS2 feel different? Um, it, there — and I have a better slide on the next one to kinda show you the, the shift — but there's a few key things, and I have them bolded on these green right here. Resilience is starting to become the conversation. During incidents, they wanna shift that focus, and this is expanding the scope and expectations, and that's why it's starting to become a little more, um, significant of what is actually evaluating and encouraging for your organization, versus just how NIS1 was being done. The ability to limit the impact is obviously huge focus, and that's where these new technologies are coming into place to help with that. And then evidence and visibility and control. So the main goal here is, organizations may feel exposed, um, but with having NIS2 in place, they feel like they're more invested in security, and it will provide more visibility and control.

What changed from NIS1 to NIS2?

Chris Boehm: So what is the primary changes when it comes to NIS1 and NIS2? Well, um, I, I helped everyone here. I tried to simplify it as much as possible into four bullet points. There's a broader scope. If you can't notice that below, on the essentials and the important entities, it's expanded. It's not just, um, the public sector. It's hitting more than, uh, the public sector, in different, in different categories, and, uh, really when it comes to full visibility of resilience. Uh, there's more expectations when it comes to that key term I just leverage on: resilience. You're gonna see this as a huge term this year, if you haven't noticed already. Um, I guarantee most organizations are gonna be focusing on this resilience conversation. Uh, when it comes to incident impact, it's, uh, it's not just preservation. So it's not just, like, a backup. You need to have more control of impact, and evidence matters more than documentation. So they actually want you to prove that: did this happen? How did it happen? And provide a full scope visibility for an audit trail. And that's, um, even where a lot of the other compliances are going to, uh, today. Now, the, this next section, we're gonna talk about the three, uh, things in security leaders, and you've been hearing me preach quite a bit. I'm gonna let Albert take over this section right here.

What do regulators want you to prove?

Albert Estevez: Yeah. Thank you, Chris. Yeah. Sure. So we, we all know that needs to, you know, shift, you know, uh, to proof. You need to prove your, your, your security by the evidences. And what are we hitting from the field? You know, as, how will you prove that you are actually limiting the impact during an incident, or what happens after an initial compromise? Like, uh, Chris likes to mention sometimes: what will happen if someone steals your credentials? How, how far they can go inside your, your infrastructure? And how you will prove it, you know? How you will demonstrate, uh, if someone that pretends to be your administrator is actually your administrator, is somebody, you know, uh, that just steal your credentials and is impersonating that administrator? And it's really hard for companies to really prove who is who, you know, without the, the proper, the proper tunnel, uh, tooling. So what prevents lateral movement once an attacker is inside? So what, what security measures do you have, and how will you prove that you have them? Right? So what are the evidences that you can show, uh, after, uh, after a breach happens? So you don't have to just describe them. So you need to prove them. So bringing the evidence. So it seems that the, the era of the, of the PowerPoint security, it's over. So we're not to start thinking that we need to bring, you know, the evidence to the regulators to prove in the, in the data happens to breach. You know, we need to grab all this information and, uh, bring them as a, as a, as a proof. So in order to do this, we know, or you, you all know, that you need to start passing penetration testings, you know. So this is the one of the proofs that you can bring to the regulators that you are in a good shape, or, or in a bad shape. So showing in a diagram that you have the security, uh, pieces in place is, is not enough anymore. So you need to, you need to prove. Okay?

How should you prioritize NIS2 gaps?

Albert Estevez: Um, thank you, Chris. So you need to do a gap assessment first. Right? So before you can apply NIS2, you need to know what is the conditions of your infrastructure. What is your security posture? So you need to do first this gap assessment. And what we are hearing from, from many of the, the customers outside is that things that they knew that they have it, and before they was okay, you know, now they are not okay anymore. So for years, security teams deal with that flat networks, identity gaps, uh, but they couldn't get the budget approvals, you know. And now, with the needs to gap assessments, they have a powerful tool to go to their CFO and say, okay, remember all these projects that, you know, we were delaying? So now this is the time, because now it's not just a recommendation. It's, it's, it's, it's like a law. You know? You need to be in compliant, because you are, you can face, uh, real big fines, up to 10 millions, you know, or I'm not sure if it's 2% of the, of the gross margins that you generate per year. So it could be, uh, a lot of money. So now the CFO, they need to really pay attention to what the IT departments, they are asking to be really compliant with NIS2. You know? So, again, so these are nice to have anymore. So they have legal, legal requirements. Yeah. So, uh, yeah. Thank you.

So then the, the reality is that as soon as you, uh — or if, if you can go back, please, Chris, just a little bit. Yeah. Now, what I was gonna say is, okay, now you are discovering all this risk, you know: that you have a flat network, that you don't have the right identity controls enforced. And now, since you discovered this and you report all these gaps, you have, like, between twelve and eighteen months to fix all these, all these problems. So, uh, you need to be really smart, you know, because, again, the math doesn't work, that you probably have, like, yeah, an average between twenty and forty gaps that you need to fix. And in that time, period of time, it's impossible to fix everything. So I think that you, you guys needs to be really, you know, strategic in the way that you decide and apply, uh, risk, you know, to all these gaps that you will identify, to be sure that you focus on the ones that they will really prevent, you know, what an attacker can do in your, inside your infrastructure. And start thinking that you don't have to always, you know, chasing new CVEs, patching vulnerabilities, because these will take forever. So we need to find better ways, like, for instance, microsegmentation, to really, you know, reduce the, the attack surface that, that you have in, in your infrastructures.

What are the top four priorities for security leaders?

Albert Estevez: Cool. So, um, then in here, we are behind. I don't know what. Right? So now we, we need to, to do — we have too many, too many gaps, and not, not enough time to run away. So, um, um, what I would like to, to give you here, like, an insight, is that focus as much as you can in containment, you know, and segmentation, identity controls. So try to then work for prevention. So instead of trying to work your strategy on visibility, detection, and response, so try to focus more in containment, you know, and really prevention. Because today, we have techniques, and we, and tools that will allow you to do this type of things that maybe five years ago, seven years ago, ten years ago, uh, the tools that you had to try to accomplish this type of, um, security principles, they were not really useful, you know, because they will probably give you more work, but they will keep you really busy for, for many years, so nobody wants that. But today, we have tools that, thanks to automation, you know, uh, so you can really reduce the times that you need to really enforce security policies everywhere, without having to, to create nothing from, from, from scratch.

So I think that this, uh, four top four CISO priorities, uh, for me is to resilience. You know? Uh, we all was reading from NIS2 to that. Control the lateral movement. So be sure that you can control the lateral movement. Proof that you can control the lateral movement. Right? So prove that you can enforce privileged access, uh, in the quickest way as possible. So usually try to bring MFA as much as you can. Uh, architect containment — uh, what means, so embrace the breach. So put you that in the position that your network or infrastructure will be compromised. You know, don't wait till that day arrives to start thinking, okay, what we will do now, you know, if someone breach inside your network. So architect your infrastructure, keep always in mind that you will breach, and then apply, you know, the security posture, uh, accordingly to, to that. And then minimize third-party exposure. So more and more and more, we are seeing breaches that happens because, you know, with the supply chain attack, or third-party, uh, companies that they are working with you, they are the one that they will breach. Um, things that they have communication or access to the infrastructure, and you trust in that access, you know, they are utilizing them to infiltrate inside your infrastructure. So pay a lot of attention, you know, to third-party, uh, exposure.

Why isn't checkbox compliance enough anymore?

Chris Boehm: Yeah. I mean, that's well said, Albert. And, I mean, this kinda hits on — um, this is not new stuff. Like, this has been going on for years. I, I even remember — it's been, this is probably about fourteen years ago — I sat down and watched a presentation at a conference, uh, from the FBI, and the FBI was talking about the Target attack, and how a third-party company — if you're unfamiliar with this — um, got through HVAC, HVAC system. This is a well-known story, uh, so you can look it up, get more details. But that was a third-party exposure that gained credit card information, uh, because they hacked the, uh, the, the point of sales, uh, credit card swiping. They collected all the credit card data. So it's just — this is, this is not new. This has been going on for years, and that's why this priority, and what NIS2 is focusing on, it, it's, it's taken a lot of evolution to get to this point to start solving those problems of how can we validate control, see what's happening, and actually build the architecture to, um, not make it so aggressive. Because that's part, been part of the problem here, is a lot of the times, it's just like, we'll throw a bunch of firewalls, throw a bunch of things in place, but then it hurts the business operations, and it becomes challenging and taxing just to do your normal day-to-day business. So this is actually pushing you in the, hey, how can your business keep running in a proper architecture design, but minimize this? So it's a great, great examples. Uh, I —

Albert Estevez: Wanna thank you. I, I, I agree. And, again, so to me, what is really important is, this framework is not just something that is good to have. You know? So if you really enforce, you know, uh, the security principles that they are there, and you prove that you apply it in a way that you can validate that they are properly applied, then it's the only way that you can guarantee that, in the event of a breach, your network will be resilient to stop the attack before it goes beyond the, the day zero. So the, the patient zero. Right? So before, everything that we hear is, okay, you should have this. Okay, show me. You know, you have firewalls. Yeah. It's cool. So, but nobody was checking if the security policies were, you know, properly put it in place, and were preventing a lot of the, the attack that may happen. Nobody, nobody cares. So you have a firewall, check. And now it's different. Now it's, okay, can you prevent lateral movement? Yes, I have a firewall. Okay. If a firewall is not enough — okay, but I have this solution. Okay, cool. Can you prove now that the attack path from this machine can reach out to your crown jewels? Oh, wait. I don't have, I don't have that. Okay. So put it in place. Right? Yeah. So you're forcing now to don't just work in the checkbox, you know, uh, matrix, and start really applying security, you know, in the right, in the right way.

What does NIS2 assume about attackers?

Chris Boehm: Yeah. I will — and that's a great transition to our next slides, since I, I know what our, our deck is showing. But I'll show it in after this one. I, I think it's this one or the next one. Um, but to, to continue kinda going with that question, like, what is NIS2 asking for? Well, this is exactly what we've been highlighting on the whole entire time. NIS2 assumes attackers are getting in. Kinda like what Albert said, my favorite phrase right now is: if I had your system admin credentials, how far can I go? What could I access? And are you validating any, anywhere across there? Um, I, I talked to a customer the other day. They're like, "Well, we don't have identity as an issue." I'm like, okay, well, explain that to me. He's like, "Well, we have it locked down. This machine only allows access to an identity." So I'm like, okay, so you can't talk to cloud access, or your network drive, or nothing? He's like, "Oh, no, we can't." I'm like, that's exactly what I'm talking about here. Like, I understand your laptop's locked down, and you may have a lockdown to a, a network that, like, a conditional access or something. But, but then you have everything else that it's exposed to. So think of, think of a developer. The developer gets in. They're in Slack. They're talking to GitHub. They're talking to whatever tools are out there, because they have a lot of exposure, that maybe even using AI to help them with the process of some new, uh, you know, modernization of coding. Well, if I use that same developer's credentials — oh, do they get, are they allowed to get elevated? They probably have access to quite a few things. Well, how far should I go with those credentials? So — for sure. That's exactly what NIS2 is asking here. Um, do you have any other feedback on that, Albert?

Why are developers a risky asset?

Albert Estevez: Yeah. I mean, now that you mentioned developers, they are one of the weakest, you know, uh, pieces in the infrastructures, because they have usually privileged access to many place. So they have use of, you know, SSH, RDPs. And then they have an ability right now that they can — they need to develop. So a lot of them, they are using AI, or even shadow AI. You know, they use the tools that they think that they need to do, to use to be faster in the deployments and developments that they need to do. And as we all know, this opens the door, thanks to the AI, a new, new vectors of attack. Like, we, we hear, like, you know, ChatGPT or Claude. Sometimes, when they, uh, guide you in developing a new, a new piece of code, they relate to some libraries that maybe they don't exist. You know, they, they, they hallucinate the, the name of the library. And there are some bad actors out there that they realize about this naming. So they are building these libraries. So they are publishing this library. So as soon as you ask ChatGPT to generate this piece of code that needs to do whatever, it relates to one of these libraries. You copy-paste this. And the developer, because it has this privilege access, they can go to the Internet and download these libraries to enter their code. So now you just downloaded a malware, you know, that will establish a command and control, and now you are 100% breach. So how we can help companies to control developers as a risky asset? Right?

Chris Boehm: Yeah. And that's just one, that's just one example. There's so many different scenarios I can think of. So, 100%. But so let, let — this is exactly — just show a visual. Uh, now, there's multiple different scenarios. Um, and, of course, we're not putting fear or anything of that out there. It's more the fact that this is exactly what's happening. You can just even look back last year to talk — look at top 10 compromises, or outages, or, um, issues that — not, not, not, not the, like, network outages. That's a different scenario. I'm talking about, like, attacks, and a company goes down. It's because this is happening right here almost every time. Now, we're assuming you have EDR. We're assuming you have everything in place here. But, again, we're talking about how far could you get if a, a user — which the identity is the most used way to get in right now. Let's just say that developer on the left side, uh, they're using the developer credentials because, unfortunately, they just found it, or who knows what. We, we don't really care how they got it, and they are breaking through their dev application. Well, now that, now that they're in there, now they can just spread and find, discover, because they have credentials, and they find that database, or, um, your customer information, or whatever. And then that's when ransomware or other things hit, because they're like, hey, now we found it. Now we know how to go around what you have in place, because we're discovering and learning. And this is exactly what happens. This is what we're talking about: the crown jewels every time.

Why do breaches still happen with EDR and firewalls?

Albert Estevez: Um, and, and — and let's be honest, Chris. So all the attacks that we hear recently to big corporations — do you think that none of them, they have EDRs, firewalls, north-south, east-west, WAF?

Chris Boehm: Yeah.

Albert Estevez: You know? It's not a matter of how many tools do you have. Right? So it's the, the mindset that you apply, and how you want to, you know, build your infrastructure around containment or not.

Chris Boehm: Exactly. Like, I would, I would say most, uh, companies have at least started dipping, or they, they could argue that they were in a process of development or something. They may not have been perfect, but it, it is an architecture conversation we're having right here. Right now, when you get into your building, or you get into a, a site, or whatever, how far can I access everything in that site? Like, the common perception here is, like, "Oh, well, uh, I have a VLAN, so it's breaking this out separately." Well, okay. Well, everything in that VLAN is still — uh, the developer can have access to. Well, does the developer have the way to connect to those other VLANs? Again, that's the same scenario. Like, you have already authorized them to have that communication network, because they have to for their job. So it, it's, it's — it can continue going forward. Like, how are you designing it and verifying through the whole entire process? Um, and there's, there's multiple ways to look at it, but, yes, I would agree. Like, they have these tools in place. Uh, and that's where the shift is focusing —

Albert Estevez: Uh, moving more from that. So, usually, the, the security constructs that you're utilizing the infrastructure — maybe some security policies in your firewalls, you know, the, the ones that they will allow you to cross from the risk to close the lines — usually, those control, they are static, and they are applied twenty-four seven. So if you are saying that your, this machine from this network, they can communicate with your Active Directory to authenticate, or that will be open twenty-four seven. So that means, if someone breaches one of those machines, you are allowing them to see the service automatically. You know?

Chris Boehm: Yeah. Yeah. That's very true. I mean, I, and I, I feel for every, um, network engineer, network architect, right now, because they have to help with the adoption of constant change in any company. Doesn't matter if you're a 50-person company to, uh, a 500,000-employee company. You're still, you're still dealing with the same issue, just a different scales. So, um, moving on to the next one. And I, I think, uh, Albert, you wanna take this one, or you want me to go to it? Yeah. Yeah.

Why is containment the answer?

Albert Estevez: Yeah. So, uh, so we, we need — we are here to help to change mindset of customers. So we, we all know that the only way to prevent the lateral movement — and this is one of the root cause of the majority, you know, the vast majority of all the intrusions, you know, nowadays — is, is containment. So we, we need to stop, you know, thinking in the way that we, we approach security, because adding layers and layers of, of tools — uh, we know that an average customer has, uh, 30 tools to deal for cybersecurity, which is insane. And what usually happens is, is that now you have a really complex network, and which is complex, usually what we say is not secure, because there are too many pieces that you need to fine-tune to what make them all work, uh, together. Right? So containment, um — what you're trying to do with containment is to limit the radius blast. You know? Uh, so make that sure that the, the critical systems in your infrastructure, they will keep working regardless that you have already an intrusion, or there is an attack ongoing. You know? Because the, the, the thing here is not to say that, okay, so we can prevent lateral movement, we can do this and this. But the moment that somebody enters in your infrastructure, they find a way to people, hear people there, and they are moving. You know? So we need to be sure that, when we design our infrastructure, our security, you know, uh, it needs to be in containment in, in mind, thinking that you are already being compromised, on how you will identify, how you will, you automatically control, you know, and automatically maybe make to prove identity to everybody, or any privileged access needs to be proved. Right? Because we are all under this zero trust, you know, umbrella, and we need to start putting in place, you know, mechanisms to really validate, uh, this. So I think that, as we put here now, right, so containment directly, the, directly aligns security outcome with business resilience. And at the end of the day, what NIS2 is trying to help us is to make, or build, our infrastructures to be automatic self-resilience.

Chris Boehm: Yeah. Well, well said. Um, so this, this is exactly, uh, what we've been kinda talking about. Like, this is where the goal should move to. So if a developer — same scenario — lost their credentials, or whoever gets bypasses through some kind of phishing campaign or application, and they get onto that machine, they should be contained in at that machine. Or even maybe, let's just say, two machines. Who, who knows? Like, it — the main goal here is the blast radius and control is there. And you would see this access. You would see that credential was used, and then they tried moving to this other machine, and then they were blocked, because they were challenged again. And that challenge you have in place for your business, uh, blocked it, because the developer, or whoever, is like, "Wait a minute. I didn't make that request. I'm gonna reach out." Um, even if that happened and they just said yes — which there is bad story that, that does happen — uh, that's where training and other things come in place. Hopefully, after the third or second time of constantly trying to move, uh, they would, they would notice that something else is going on. So what this is describing right here is, you see that little shield on every asset? That is, uh, microsegmentation. And what that means is, every asset has its own enforcement. It's not, uh, well, here's a VLAN in the bubble, and you have to get authorized or learn. This is a dynamically changing request credential. Like, this is what microsegmentation should be doing for you automatically. It shouldn't be a, well, here's your rules in place, and here's the static, and you need to go up there and update them when things change. No. It needs to understand your line of business and work fluidly and work for you.

Albert Estevez: Yeah.

Why move from IP-based to identity-based security?

Chris Boehm: So the, the, the next context is really around an identity. And I, I think this is the — because Albert brought it up, I'm a let him drive this one as well. But, uh, this, this is more talking about the identity shift versus the network shift, and this is a great mindset change.

Albert Estevez: Yeah. So we, we, we seen over the years — and all that, everything that is related to security that is applied only to customers, like IP addresses, networks — you know, they prove that they fail in protecting a lot of these infrastructures. Because, you know, an IP, what it means? So, so when you generate the security policy, you say this source IP can communicate with this destination IP — what that means, you know? Because what is an IP? Who is behind this IP? Are you checking if the content of the, of that host server change? You know? What is the, the purpose of that host? And, again, so we, we, we don't know. So we guess, and we trust that this IP is always my Active Directory, this IP is always my SQL Server. But what happened is somebody, you know, uh, duplicate that IP? Is that inheriting all the rights that, you know, that IP has? Is this secure? And so we, we know that not — uh, that is not secure. So I think that the shift, the real shift here, is try to move security policies from IPs to identity. You know? So identity is, is something that we can prove and validate constantly, to be sure that you are you, and you can prove through, uh, probably a multifactor authentication. So something else than not just the username and password — maybe somebody can steal you, you know, and then utilize it, impersonate you. But what about if I ask you to prove your identity through your fingerprint, for your face, your Face ID, you know, uh, YubiKey, uh, smart card reader, cryptological, whatever? Right? So we can change the controls from just an IP to who you are. And based on who you are, you will see, you will get access, or do what. Right? And, again, helping companies to move something that complicated to me, switching security policies from, um, IPs to identity, you know, uh, and even more. Adding this MFA layer, uh, for us, it's, it's cornerstone. You know, it's something that they think that we, we do really well. And I think it's what NIS2 is trying to, to push and move everybody. Right? So get rid, as much as you can, of security policies — static policies that they, you know, block or allow things based on the IP that you have now. You know? And instead of that, apply zero trust principles: that who you are, and basically who you are, and know what to offer you, you know, and only that, and for a period of time, because it needs to be, uh, something that expires as well. So you cannot just get access to something forever. So you need access now because you need it, and that has an expiration time. After that time, if you still need it, request again, you know, your access, and we will grant it depending on if you still, uh, validate your identity or, or not. So, uh, so I know that you all will get all these slides at the end of the webinar, probably. So I think it's a good reminder, you know, that whole identity-based access controls helps civilization to enforce this privilege dynamically, uh, that, you know, as environment change, and provide the clear and more defensible evidence, which we are all here to, you know, to understand how we apply NIS2 principles in, you know, in our, uh, daily basis, uh, security actions.

How does NIS2 push resilient architecture?

Chris Boehm: Yeah. Yeah. Well said. So the, the core thing that we've been kinda hitting on the whole entire time is, compliance has been, like, commonly that checkbox approach. You're going through, you're saying, hey, we have MFA enabled on, you know, key assets. We're making sure we can hit cyber insurance. We're hitting these other things. Where the shift right now is, instead of focusing on just meeting that compliance conversation — even though Mitsubishi is compliant — but even the compliance is forcing you to go into more of a resilient architecture design. And that's where the shift, I would say, is here that we're focusing on. So instead of, uh, staying, uh — like, not staying ahead, and building a design of your, uh, your business to fit the new modernization that's happening right now — NIS2 is a great opportunity for you to start doing that. Like, if you're already in the process, you have that eighteen-month plan, how can you redesign your architecture to grow and adapt appropriately to more of a modern security architecture, versus a static, flat, uh, insecure — uh, I mean, a basic secure, I should say. And there's more charts out there that you can say, like, where's my maturity matrix at? This is just one of them out there, as an example. But the, but our focus here is this. And this will really shift your — how can I prove to, from a board, to my CSO, to the, the VP of architecture of our company, our CIO, our confidence of what is happening in our organization, how we can prove it from an audit trail and meet our regulations, and moving forward, uh, or, like, here's where we're — you can adapt easier going forward?

Albert Estevez: And I think that, you know, before now, then, uh, to me, this is a great opportunity, you know, uh, for all the companies to really adopt, you know, zero trust, uh, through NIS2. Uh, if you remember before, you were trying to chase your CFO to convince them to spend and invest money in this project and this other that will help you to improve, you know, the security of your infrastructure, and that sometimes was questioned on that: do we really need this? Uh, maybe if we do a different stuff, we will be more compliant, whatever. I think that with NIS2, this will shift. This will change. And now you will feel the, the pressure from the CFO that, okay, show me the evidence to don't — so we don't get fined. You know? Okay. So you want the evidence to, we are not to don't get fine. So we need to do and achieve this project, this project, and this project. Otherwise, I don't have any, anything, you know, to prove that we are protecting our company, we're preventing the lateral movement, or we are protecting our, our crown jewels. So I think that we, we all should utilize NIS2, you know, as a, as a —

Chris Boehm: Not as a —

Albert Estevez: Tool. Yeah. Yeah. Yeah. So — yeah. It's true.

What does NIS2 operational readiness look like?

Chris Boehm: So, uh, as Albert said, this is just, uh, like, a great checklist. Like, are we doing the following? Is this operational readiness? Um, I, I — this is a high level. Uh, we have lateral movement. It's prevented. Can you prove that you can do that? Privilege access is enforced on the network. Uh, containment is built into the environment. Third-party access — this is all the kind of things we hit on earlier. Is it restricted? Can we prove what they did? Can we get in? Are they not getting into systems that they shouldn't get to? Um, and are controls provable? That is huge here. Like, can we show, through the whole entire audit trail, visibility and control, what was done? And we can walk through that of a full scope of breach, versus, yeah, they got in, now we had to do a disaster recovery and spend weeks of going through this and log and try to find where they're at. You, you ideally want a system that's doing that for you. So I, I, I know we've kind of been, uh — Albert, did you have something? Sorry.

Albert Estevez: No. No. No. No.

How does Zero Networks support NIS2 compliance?

Chris Boehm: Okay. Uh, I, I know we've been kinda hitting on, like, what is NIS2, how it's helping. Um, and we haven't even talked about Zero Networks. So first off, thank you for joining us. Uh, we're happy for you to be here. Like, how is Zero Networks doing this, and what, who, who are we? Well, Zero Networks helps organizations prevent attacks, minimize blast radius, and maintain business continuity, even when attackers get inside. As you kinda saw in those demonstrations before, the term microsegmentation is a common used term of what our company is doing for you automatically. We have three different things on a single platform. For example, the microsegmentation conversation. So that's client and servers being isolated down to business use. So we, how we do this: we learn, we adopt, and we provide policy automatically for you. Now you have full control. You can do it however you want. And this could be agentless. This could be with an agent. It's gonna be really the design you want it to be. When it comes to OT, PaaS, IaaS, client, servers — it doesn't really matter. That is kind of the bread and butter of where our company started. And then we started — because of what we're doing, we noticed exactly the conversation NIS2 has been bringing up. Well, identity is becoming a huge control vector, and we already saw that. So how can we prove and control from an identity level, as well as a microsegmentation strategy? So now we do identity segmentation as well. And I think of service accounts, talking to databases, talking to things you don't even know. We're learning that, providing you insights, and containing that for you. And we do that to ourselves automatically, because when you use our product, we automatically control our visibility and, uh, and segment ourselves. And that's including administrative, over-privileged accounts. Now, the next one is the, the zero trust network access. The common scenario — and this is exactly what our customers kept coming to us was — is, we have that remote user. We have that remote employee. We need to control and have visibility and access into certain assets, but we want it to be just like your microsegmentation strategy, allowing them to have temporary access. So we've created a zero trust network access capability for you as well. And that's the core three things at Zero Networks that we are providing to customers. This is today, and we have right now.

Albert Estevez: Something interesting regarding the ZTNA is that we don't need to open any port to Internet, you know, twenty-four seven, to be exploited at heart. So I think that the approach that we are taking, uh, really likes a lot of our, you know, our, our customer base. So instead of relying in third-party security companies to send all your traffic, you know, to those clouds that someone else is managing in order to get access to your infrastructure — you know? So you need to pay this toll, that sending all your traffic to get, you know, more, uh, latency, and you are losing all your digital, you know, sovereignty. Because if that partner stops working, you don't have access to your infrastructure, which is crazy. Right? So I think our approach is very good.

Chris Boehm: I was gonna — uh, sorry, Albert. Uh, I, I would say, like, the big differentiator for me, and when, when I look at our ZTNA technology, is I can actually track where user came from, where they accessed fully, instead of seeing a generic IP address of a cloud task workload, and everything seems to be going through that. It, that's a huge — like, it kills the whole entire, uh, investigation conversation. Like, well, everything goes through here. Well, I don't, you know, I, I don't understand. Now I can actually see that full trail of what they did and how they did it, uh, based on the identity, based on IP address, external IP address. Like, you have the north, south, east, west conversation all right there, um, on what, what they're accessing and doing. I think it's a huge differentiator. I agree.

Albert Estevez: Yeah.

Chris Boehm: Um, so why identity controls and segmentation matters? We kinda hit on this already. You have the enforcement control of segmentation. You have real-time containment. And, by the way, this is based on Gartner. This is not based on us. Uh, and you stop worrying about vulnerabilities. Now, from a compliance and requirements perspective, uh, that — and we, we've been hitting this quite a bit — it's the audit visibility. It's huge. It's, uh — I mean, I, I know some customers that, that is one of their primary focuses: is, can we prove it? The lateral movement, other things, are obviously a priority, but this, the compliance requirements, is a big one for a lot of organizations, ex—, including banks and, uh, certain people that have, uh, regulations they have to hit, like NIS2. Simplifying compliance management.

Albert Estevez: We, we always say that — sorry. We always say that many customers, they come with, with Zero Networks, uh, for the automation, but they stay for the visibility. No? You know, the, the, the level of visibility that we are bringing to them, it's, it's, it's insane.

Chris Boehm: It is insane. We have a, a, a simple slide for you guys. This is kinda — see that layer of visibility in a minute. And, of course, the other one — this is a, a great conversation piece as well, and Gartner hits it — is network complexities. I mean, think of merger and acquisitions. Think of, um, you know, the company has changed over thirty years. Now there's this VLAN network, DMZ. This control of multiple buildings, cloud workload. It, it starts getting really confusing. You start falling back. Things have changed in each building. It's all static configured. And then you have these holes that, whenever you could do a red team, and they're like, "Yeah, look at how much access we have for you." So this ID control and segmentation would solve all of this for you, because it's automatically dynamic with learning. It's blocking per asset for you. You don't even have to change your network stack. The network stack can leave the holes, but when they try getting even past that per point, then it's controlling each asset. So it, it, it kind of is a — it a complimentary, or it just depends on how your design wants to be layered to your network, uh, complexity? So, uh, it — I mean, Gartner hit, hit it very well. I think, Albert, uh, you definitely are the expert here. You already said you have about fifteen years of Palo Alto experience. Uh, like, talk — let's talk about the north, south, east, west protection. Like, um, why, why does this matter so much?

Why does east-west protection matter more than north-south?

Albert Estevez: So we — I mean, the, the, the experience of working in the, in the firewall industry for many years, you know, and trying to protect always north-south, uh, traffic, uh, gives me the, the vision that is not enough. You know? So you try to be always prevent, prevent, trying to prevent the new type of attack. So that means that you need to be sure that you configure everything in your firewalls, in your WAF, you know, and so on. You try to think and imagine all possible attack vectors that somebody from the outside will try to utilize, you know, against you. So you try to put as much layers of prevention one on top of each other. Right? So you have IPS, anti-malware, IV antivirus, uh, URL filtering categories. Um, but you always seems that you are late to the game, because when a new technique is discovered — like, if we talk about, you know, some type of encryption that you cannot just decrypt. So you don't have visibility. You allow a traffic now that is using some type of algorithm, or maybe post-quantum cryptography, that, you know, you don't have configured in your infrastructure to, you know, decode and understand. So to try to apply security on that traffic, you're blind. So you, you are allowing attackers to get into your infrastructure. And so focusing only in north-south security, okay, will not help you to prevent that. At some point, somebody will find a way, you know, to bypass all those mechanisms that infiltrate inside your network. From that moment, you know, you are screwed, because usually the firewalls, you know, will not prevent the lateral movement. So we need to do something else. I think that this leads us to maybe the next slide, or —

Chris Boehm: Yep. Yeah.

Albert Estevez: If you want to chime in, Chris.

Chris Boehm: No. No. You're, you're, you're right. So, I mean, just a hit on it: like, north-south movement is huge. And that's where, like, ZTNA has been coming very popular recently. You're there — the VPN is not the same kind of technology. It's not as you repress, because you want something that has performance and scale capabilities. So the exercise, and, like, internal-external workers, has been a big thing. We have a multi— because of COVID, companies are still focused with this, with the hybrid work standards. Though north-south is relevant, but it's — again, you're bridging the gap with your north-south communication to allow the east-west traffic compromises that is happening. So it's just, it is just how the business itself is shifting the focus in. So when it comes to east-west traffic, um, that's where lateral movement is in the enabler, because you're kind of just allowing it for them at this moment in time. Um, and that's why privileged ports, like RDP, SSH, um, every, everything that you think is just an administrator uses on a regular basis — those are usually open because, again, administrators wanna use them. So if you manually go through each one and try to block it, well, then you have to go in. It's, it's a very painful process for businesses. So they just don't wanna create that business friction for themselves, because they may even have a partner that goes in. They need to enable that partner. It could be a different person. It just, it just depends on, uh, how your company is designed for management of your ecosystem. Even if you have that tool that just does it all for you — like, "Oh, no worries. I, I use an automation tool that pushes down policies and changes." Well, that, you, right there is your east-west, uh, like, attack vector. Like, look at — you have it open for that tool. Uh, is it, is it doing what it's supposed to do? Is it, was it allowed to do certain things? Like, do you have to have some kind of control visibility that makes sure that those privileged ports are only doing what they need to do? Uh, which is why it's a primary focus right now.

Albert Estevez: Yeah. So many companies, they, they are spending a lot of money trying to protect the privileged access. Right? So they are forcing their administrator to utilize, like, jump boxes, or some specific machines that they are the only ones. So at the end of the day, you are adding a lot of complexity in your infrastructure. So you are now adding another, you know, um, piece in your infrastructure that, if it fails, you lose access to your infrastructure. You know? So everything needs to be working twenty-four seven. But, again, I think that this is not the way, because adding more complexity make things really complicated. But at the end of the day, keep those ports open at the host level. You know? That doesn't remove the security issues that they are, you know, around those privileged ports.

How do you control admin and service accounts?

Chris Boehm: Yeah. Well said. Um, so, like, where — this is the identity conversation again. Like, how does an admin account come in, and how does a service account? I kinda gave you a high level. This is just a visibility. Just think of service accounts as anything. You can think of database administrative. You can think of, um, from your cloud workload visibility, uh, synchronizations, accessing your assets in your environment. Those accounts, usually, you assume are perfectly fine, and they don't do much. But they're usually static. Like, you set it up. You don't change it. It has access to multiple assets, and it just continuously does what it's supposed to do. Well, if that was compromised, would you notice it? That's the challenge here. And that's exactly why we took it as a focus point for us. Then with your administrative account. Uh, like, are you challenging your admin accounts to do what they're supposed to do? And are they — what if it was abused? How far could I get, and what can I do? And where is your — like, hey, are you really who you say you are? Or, or you don't normally talk to this asset. Like, you are authorized, but let's verify again. Uh, like, that, that's where the zero trust mindset comes in.

Albert Estevez: 100%. So, uh, pledging least privilege access, that should be a priority for everybody. And something that we challenge many customers, you know, when we are there, is, like, do you know how many service accounts do you have? Where are they deployed, in which machines? And what type of privilege, or logon types, they are allowed to do? And usually, the answer is creek, creek, creek.

Chris Boehm: That's right. Yeah. They usually don't know. Uh, so we identify that automatically, and it's, it is not easy. Like, we had to build algorithms to find these, and then identify, and then learn on them, and then provide policies based on that. So, uh, it, it is, it is a very interesting conversation for sure.

How does network-layer MFA work?

Chris Boehm: So I, I did promise that slide earlier: like, how we do it, what visibility we have. So your traditional, um, multifactor authentication: you're going through your identity provider. You go in, and you authorize access. You gain access to your machine. It could be a YubiKey. It could be whatever you have in place. That's good. It's secure. It has an extra layer, and you're meeting a lot of compliance and regulation by saying, hey, we verified that, uh, we went through a Windows Hello or Windows whatever, and we got in. Well, unfortunately, sometimes those exploit, or it gets pushed, or who knows what the user is in. Okay. Well, how far can they have? Usually, at that point, because I've been authorized, I have that token, I start having access to everything when it comes to applications, to other things on the network stack, to, you know, the local network. Like, everything is just connected by design. We don't wanna create friction to our users. We want it to be fluid, easy, like you want to do your business and operation. Where we take things a little bit differently — which is that right side — is we then challenge it on the application layer and the network layer for you. So we say, okay, well, you're in, you got in your machine, you will multifactor authenticated, you went through your appropriate procedures, and then you're trying to remote to this application, which this user never talks to, or rarely talks to. And, but they need elevated privileges, and they need to talk to something, um, that they shouldn't normally talk to. We're gonna say, hey, are you really who you say you are? And then give them temporary access. And we do this from a layer one, two — I mean, really, layer three to layer almost seven. Uh, we don't highlight seven here, but it is — we go to that level of visibility control, because we can actually see your application communication down to the Windows machine app, uh, like, the, the OS communication, down to the network stack communication. They're just part of the scope, and we challenge that right there for you.

Albert Estevez: And this is revolutionary. You know? So the way that we, we, we, we applied, you know, that we can just close by leveraging the native operating system of your assets. We can just close the access to all this privileged port, you know, RDP, SSH, you know, when we close them. So nobody can use them to do any spread of malware or do lateral movement, because now they are closed. And then we, we patented this functionality, where we can allow, you know, specific users, in when they want to connect, to communicate with this port, alright, now is closed, they will receive an MFA. And after the MFA happens, we dynamically will open the port, you know, for those users, for a specific period of, of time. So business, to me, is, is mind-boggling, because I —

Chris Boehm: It, it is, it is very cool to see.

Albert Estevez: Oh, yeah.

Chris Boehm: It's very cool to see.

Albert Estevez: Yeah. And it's very easy to deploy, because you don't have to, to, to install or deploy anything just to secure now your application. And maybe you have an application that, they, it doesn't support MFA at all. It's a legacy application that you should be protecting, but you don't have the tools. Right? So we can just block the access to it, and then defer at the layer three these MFA piece that we have. So it's the only way that you will see the port open: only after you prove your identity, in the case that you have the rights. You know? And as you were mentioning, based on identity, we can do exactly the same for identities. So we can apply least privilege. We can remove for your administrator the, the logon rights, you know, in case that you find one of these ports open. You try to — you, you get the request about who you are, and you stole some credentials, or you have your own credentials. You put your username and password, and that is not enough. That is not enough, because right now we got the logon for RDP or interactive sessions. So in order to log on now, you need to prove your identity, but you need to be in this VIP, you know, group, that it will receive the MFA, or, or not. So without the MFA, without proving your identity, regardless if you want to see the port open or you want to use your, your identity, you need first to prove your identity through a multifactor authentication. So making username and password useless in your infrastructure, which is to be insane.

Chris Boehm: Yep. Yeah. I mean, and this is exactly how we provide a full audit trail visibility for you, uh, when it comes to business resilience, showing your auditors, like, it's because we're implementing this, and we have to know what's going on, and we log it through the owner process. So that's exactly how we're accomplishing this, in case you're curious. The, the — there's some big things that make us unique in the space. I mean, we, we kind of mentioned, this is not new technology. The, the concept of segmentation is not new. Microsegmentation has been painful and challenging through the years, but that's where Zero Networks took it as their mission. Uh, myself included — ex-Microsoft, people from Palo Alto, people from a lot of network security companies — all came together and said, hey, we wanna solve this problem, and we wanna make it easy and simple. It just — to deploy us takes about an hour. That's, that's it. And that's, that's with the friction of, you know, fighting it. Like, do I have access to this machine? It could really take ten minutes. After that, it learns and provides dynamic control and visibility. So it moves very quickly, and then you, then you can do segmentation. So we say in months, versus something that takes manual effort, consulting hours. Um, you have to have agents deployed. It's, it's siloed into certain segments. We truly see everything in your environment, which is really powerful right there, because we have to know what is talking to what. We have to know what identity is talking to what, in order for us to provide the capabilities we've been talking about.

Albert Estevez: Yeah. And we try to validate even the assets. Right? So it's not just that we are talking about IPs to IPs. We are validating that an asset is an asset, you know, and that doesn't change. And if it change, we update, you know, the EDP of the asset, to keep, you know, uh, sanity between the, the network assets, you know, with the security policies that we are gonna orchestrate in real time.

What do customers say about Zero Networks?

Chris Boehm: Yeah. Exactly. So this is, this is also something that we do automatically for you, and with, uh, with learnings of each asset. So exactly what Albert mentioned. Um, just don't take it from us. We, we wanted to at least show this. This is, uh, feedback from our peers. We're, we're very proud of it. We have a lot of companies on the logo slide right here that are leveraging us today. Um, we're across the world. I, I mean, the globe. Uh, it's just the fact that, uh, we, we have offices in Japan, uh, Australia, um, uh, Spain. I think — I'm trying to think of all the countries. Like, we're, we're literally expanding. It's amazing how fast we're moving since 2019. Um, we're — yes. So we're very proud of it, obviously, where we've got to today. And the reason for this, and most of them, is because we're delivering, we're doing it, and are hitting a 100%, or 95%, microsegmentation in months. Right? We're meeting those, uh, those pressure challenges of those eighteen-month deadlines. Can we do it? Well, I just told you we can do it in a few months. You can even delay it to six months, but you're still hitting that eighteen-month deadline that you have. So that is a huge factor for us right now, because of how fast and easy we are to learn, adapt, and deploy within your organization, while causing no friction for your day-to-day users. This is, this is impacting your privileged ports and, uh, over-elevated things — like, things that you should be aware of already — and it learns for you. So —

Albert Estevez: Yeah. So what is amazing is the love that we get from the customers. You know? So, actually, uh, we ask customers, if you have to pick a cybersecurity tool only to move, uh, to the next company that you will move, which one you will pick? And a lot of them, they say, "I will take Zero Networks, for sure." That is something that is — we are really, really proud. You can see it in Gartner peer review, Peer Insights reviews, that we have five on five. And our CSAT score in satisfaction in customer support is plus 74, which is, it's, it's out of, you know, every, everything is amazing. So —

Chris Boehm: It, it is amazing. I mean, even, it still blows me away, uh, that at Black Hat, we had customers on our floor just talking about our product. I'm like, I've never seen that before. That was a first for me. Uh, so it's just incredible on how much love we have from our customers.

What's next: AI, post-quantum, and beyond?

Chris Boehm: Um, I, I know this is one of the things that we wanna talk about, and I and Albert kinda dipped into it a little bit already. But where, where is the future kinda going? And we wanted to just highlight on this really, uh, as a, a nice wrap-up item of how to keep up, what is something to come next. And I'll, I'll let Albert, uh, dip into this one, and I can add my feedback afterwards if he somehow misses it.

Albert Estevez: Well, yeah. For, for sure, there are things that needs to be then, you know, contemplate, like AI model security, you know, ML adversaries — uh, how you will prevent them to break into your infrastructure, how will you secure the AI, because we all understand that everybody will be using AI somehow, internally, externally. Um, there is another threat that we talk a lot: it's the post-quantum, you know, resistance. So how we will need to deal, you know, with all — updating all of our SSLs, algorithms, you know, VPNs, IPsecs, IT, you know, to something that will, you know, survive, uh, an attack, when we don't need to wait to have post-quantum compute — so quantum computers generalistic, that they will do everything. So we only need to have a quantum computer that is specialized in breaking this type of algorithms. You know? And that is maybe — it's not that far. So you all be hearing about the, the technique of harvest now, decrypt later, because, you know, the hackers, or nation states, they know that if, if you start collecting traffic which is encrypted today, and they cannot decrypt, but maybe in five years, six years, they will have the power to break those communication. Probably, the data inside those, you know, encrypted communications — probably, they will still valid, uh, a lot of them. So I think that this type of challenges and mystery should be covering, uh, for, for sure. I'm not sure if you, Chris, have any others.

Chris Boehm: I, I would agree. I, I would love to say, um, I have full faith in all compliance and regulations out there. Um, usually, they're a little behind, because they're, like, actively working right now in validation and confirmation, and solving a problem today, not the future. Because that makes sense. Like, we're solving what's happening today, and then it takes years to implement it. Uh, you can see NIS2 is back in 2022, and we're talking about it in 2026. So, um, I —

Albert Estevez: I would take 10 to be out.

Chris Boehm: Yeah. Yeah. Yeah. Uh, I mean, I, I definitely see AI as part of the conversation. They may dip a little bit in quantum as a, um, per— like, a prevention, and just be prepared for it. I think there's gonna be a maturity of it, uh, on all regulations, uh, because they're gonna change. I even — I mean, personally, me, I've tried to follow where AI regulations is happening across the world right now. None of them are really, uh, heavily enforced on the cybersecurity side. It's more of the, you know, protecting the citizen side at this moment in time, uh, and protecting our young. Um, it, it will be interesting where things change when it comes to full AI cyber resilience, and making sure the maturity model is out there, and scope visibility. I think all those things are still evolving today, because the — unfortunately, the product is changing that much today. I mean, look at how all the LLM AI technologies out there are adapting. They're constantly changing. Uh, it's, it's like every month. You don't even keep up with the changes, because it's so often.

Albert Estevez: Yeah. Even today, you know, that is the, the World Economic Forum in Davos. Uh, some of the most concerning, you know, issues for CEOs right now is the deepfakes and phishing campaigns that they are suffering. So they got tricked to be, you know, scammed, uh, in a ways that we never seen before, thanks to the AI. Right? So — yeah. Let's be prepared.

Chris Boehm: Yeah. I, I mean, that, that'll be a hard one too, because, unfortunately, most of our — these technologies are open. And you can find full open-source, unlocked technology out there for AI image, uh, configurations. It's, it's obvious. Like, it, it's, it's gone. So the, the — I guess that it's out of the bag. Like, we can't control it. Now the question is, is can we identify it? Well, then why would AI not be able to learn how to, uh, you know, break your identification? That's exactly what happened when students even, uh, took all tests, and, uh, they're, they're like, "This looks like it's written by AI," and they argued, well, is it written by AI? Because, you know, AI is just borrowing information. Like, there's this, there's a whole debate about it. This is definitely not the right call for it. But, anyways, I would say, from a, a, a revolution, uh, next steps, I definitely see artificial intelligence. I see, um, even business resilience focusing a little bit more, uh, because it, it is going in that direction — more audit visibility and control. And then I also see quantum dipping in at some point, because it, it's, it's not gonna — like, maybe gonna happen. It's gonna happen. And we already see it in the, uh, expectations on the next few years. Um, but I think it'll be a slow adoption in the very beginning. No. At least with, like —

Albert Estevez: A year from the rectangle. From, from incident response to resilience by design. You know? Yeah. This is what we are going to see everywhere. Cool.

Chris Boehm: Well, I mean, I, I know we had a Q&A session. I think we, unfortunately, went a little over. Um, I just wanna say thank you for everyone here. I'm sure Albert feels the same way, for listening to our presentation, um, and have a great one. Hopefully, you learned a little something.

Albert Estevez: Yeah. Thank you.