Identity Is the New Perimeter: Enforcing Least Privilege Access Everywhere

Summary

Attackers aren't breaking in anymore. They're logging in with valid credentials, and most identities on a network aren't even human. In this ViB webinar, Zero Networks Field CTO Chris Boehm and VP of Customers Nicholas DiCola explain why identity is the new perimeter and why identity segmentation only works when it's paired with network segmentation. They also demo how Zero Networks automatically discovers service and admin accounts and locks them down with MFA.

Key takeaways

• Attackers log in, not break in. Malware-free attacks rose from about 40% to nearly 80% between 2019 and 2024, and machine identities now outnumber human ones.
• Overtrusted identities are the common weakness. In the 2022 Uber breach, an attacker wore down a developer with repeated MFA prompts, then moved through the internal VPN to source code and customer data.
• Identity segmentation enforces, not just observes. It restricts when and where admin and service accounts can log in and requires MFA for privileged logons. PAM rotates credentials but doesn't block where an account can be used, and Microsoft's tiered model is hard to implement with GPOs.
• Identity segmentation needs the network layer too. Unused ports must be closed and privileged ports like RDP opened only after MFA. A single MFA prompt then grants both network access and logon rights.
• Service accounts are discovered and locked down automatically. For example, a backup account can be limited to network logons, and dormant accounts end up blocked without being disabled. One bank's admin spends 15 to 30 minutes a week reviewing new rules.

Speakers: Moderator · Chris Boehm, Field CTO, Zero Networks · Nicholas DiCola, VP of Customers, Zero Networks

Moderator: Good afternoon, everyone, and thank you for joining us. We'll go ahead and get started here in a few minutes. Before we do, I'd like to give you a minute to go ahead and test out your chat function. Let us know where you're tuning in from. I am live from Houston, Texas. Alright. Seeing a couple different states popping in here, and countries. Great. Alright. With that, let's get started. My name is Kara. I'll be your host as we discuss today's topic, Identity Is the New Perimeter: Enforcing Least Privilege Access Everywhere, brought to you by Zero Networks and hosted by ViB. Please use the Q&A button in your window to ask questions. We'll do our best to answer all of your questions. And for those who don't get to, we'll follow up after. There — resource box will contain a few links Zero Networks would like to share with you all. And now, without further ado, I'd like to introduce our speakers, Chris Boehm and Nicholas DiCola.

Chris Boehm: Hey, everyone. Um, as a quick introduction, myself — um, I, I'm the field CTO here at Zero Networks. My primary role is working across the whole, in our business and operations, whether that's marketing, engineering, sales. Um, I work with customers directly, including some of our biggest customers here at Zero Networks. Uh, Nick?

Nicholas DiCola: Thanks, Chris. Uh, good — hey. How's it going, everybody? I'm Nicholas DiCola, the VP of customers here at Zero Networks. Uh, been here about four years. Prior to this, I was at Microsoft for fifteen years, and, uh, I work with our customers on all of our technical issues and, uh, engineering challenges.

Why are attackers logging in instead of breaking in?

Chris Boehm: Yeah. Uh, I — by the way, me and Nick used to work at Microsoft together, and that's how we know each other in the past. So, uh, any of our Microsoft peers watching this, it's a shout-out, and nice to see y'all. Um, let's go ahead and get this kicked, uh, kicked forward. One of the big topics that's been, uh, popping up throughout the past few years — it's not new, but it's been coming more and more, and I have examples in a little bit — is hackers are not breaking in now. They're logging in. They're getting through the normal patterns and path of your organization, uh, which is unfortunate, because you've hardened it and you locked it down, but things have gotten a lot more complicated. Uh, next slide, please.

Why is the network edge no longer enough?

Chris Boehm: Uh, as an example on this slide: your networks and configurations in your architecture is not just simply, here's my office, I've locked it down. No. You're a SaaS solution. You have data centers. You have clouds, remote endpoints. You have work-at-home users. It's not a single, uh, checkpoint, or a single choke point of communication. That's why products like ZTNA has popped up, or, um, other network communication protocols that are just saying, we'll map it all together for you, or just host everything in the cloud. Unfortunately, we still have our laptops, and we still have our machines, and we still have our servers and cost of the cloud. So it just makes things a lot more complicated for the business, and your network edge is just not enough anymore, because it now is the person, the application, the place, the credentials, the session itself. You have modern apps. You have Kubernetes workloads. It just — the sprawl keeps spreading within modern organizations.

These are some data points for everyone in the audience. Uh, if you're unfamiliar with this, uh — for example, on the left side, I'll start. Uh, Verizon did report this year about almost 70% of breaches rely on non-human malicious elements , uh, for the use of stolen credentials. Uh, so that's something that's very insightful for, uh, just for me as a practitioner, of understanding, like, how are people, and how are hackers getting in. The other one, which is incredibly scary, and I kinda brought this up a little earlier, is attackers are now relying on valid credentials, not malicious software, breaking in and gaining access. Those zero-days do occur. That's why it's not a 100%. But it's still, uh, today, or one of the more prevalent ways of, after you've gained access into your environment, it — it's just been given instead of stolen. And then, as the far right side, this is from SC Media. Uh, 70% of networks', uh, identities are machine identities, and that's true. I just saw a post about a month or so ago where, where I think it was the EU just shut down — I think it was a, a couple million eSIM cards that are just robot-driven to act like, um, just phones, and just to author— send text and authorizations, and try to scam me and gather information. And they shut down a giant farm, and you just think about the numbers of how many different identities that is to manage, and just scope, and collect. It's — it doesn't surprise me when you see that a chunk of the identities out there are not even, uh, users themselves. There's more service accounts and, uh, other assets that are connected in other environments, like IoT devices, for example.

So just kinda showing the trend over the years, from 2019 to 2024. Uh, I kinda mentioned that the high attacks are coming from malware-free attacks. Uh, so you're seeing people that are just getting compromised and gives visibility. This is just showing the trend from 40% to almost 80%, uh, year over year, that are malware-free, of gaining access into your environment. And that's through phishing and other things, of course, and, uh, but it's just really — it's malware-free. That's the key thing that I'm highlighting here and to emphasize on.

How did attackers move from a police body cam to the network?

Chris Boehm: Now, this one was actually brought up to me, and I asked, uh — I wanted to have this in here for everyone to see. I was talking to a, a police department just about a, about a month ago now. The time's been flying for me. Um, and, uh, I asked them, like, hey, is there any real-world scenarios that you ran into that someone just moved across an environment? And I'm not gonna talk about where, but one of them was a, a scary scenario: is the police department — as you may or may not aware, if you watch police cam shows or whatever, they all have body cams. Well, unfortunately, someone jumped through a body cam, which is connected to the police car, which is connected to their network databases and their servers, so they can protocol and look up people, uh, when they do a background check, whatever is necessary to call back in. And because of the vulnerability of the — and this is, this is, uh, just as an example of the body cam, and jumping to the police car, and gaining access, because they've already gained access to the machine. They were able to jump around and gain control quick— quickly in their environment. So it really highlighted some main things to the police department: is they didn't have visibility of what their application was actually talking to, um, how off— like, what identity requests are doing, what actions. Is it legit? Are they doing what they're supposed to do? Like, the body cam should just be sending data just to the laptop, and that is it. Obviously, that was a little, uh, overeative at one point. And then the challenge of maintaining the identity lifecycle and employee, uh, like, visibility itself. So as you know, um, especially in the public sector, think people go in and out. There's changing of profiles. It's easy to miss certain things — a lot of zombie and legacy things in your environment. So they saw this as a, uh, a real challenge that they're facing in their organization, including, of course, that, uh, body cam example.

Why is least privilege so hard to enforce?

Chris Boehm: Uh, this is from the Identity Management Institute. Uh, I'm just gonna read out this phrase for everyone here. Uh: "The architects that were once tasked for protecting a network perimeter through firewalls and intrusion detection systems now have an unmanageable, highly intertwined tapestry of identity-validated points that span hundreds of environments and trust domains. Every login prompt, every API call, every session token is a strategic strong point on an emerging line of defense." This is so true. Um, one of the main things of when I was working at Microsoft was the fear of how much API exposure we had in our cloud environments, just as a simple example. I would open up protocols, applications, authentication. I've just had to open up everything. And the one thing that I always did, when I challenged access, when I work with partners and customers, is: how much privilege do you need? How much access do you need? And it was extremely time-consuming. It's not something very easy. It's just something you literally have to give least privilege, and then deal with an individual — independent session for that one period of time, and, and say, here you go. And then, more often than not, I would have someone come back: "Oh, I need full rights. I mean, unfortunately, I just need full rights to get my job done." No. You don't need full rights. Explain to me what you're trying to accomplish. So it got really co— uh, hard, and, um, exhausting, and that was just from my simple environment, that when I worked with customers. Imagine this for a whole entire ecosystem, where you have potentially five, or 10, or a 100,000 customers — and I see customers as your own employees for your own business, or even your customers that you're working with. So it can get very cumbersome when you're trying to understand every login prompt and what is happening in your environment. And I take this to heart, for sure.

What do Uber and other breaches have in common?

Chris Boehm: Uh, some real examples. I didn't bring this up a little bit earlier. I used to work at SentinelOne, um, and I, I actually was part of the Uber 2022, uh, scenario. SentinelOne was there. They're actually doing what they're doing. Uh, so it wasn't a problem with SentinelOne itself, but we were brought in in that scenario. Um, one of the things on the Uber attack: it was not malicious. It was actually — the attacker just reprompted over and over and over to a developer. And what happened was, the developer is like, "You know what? I'm done with it," and they should accept. So that security, and all the measures that their security team put in place — they had, they had everything that you would think you should have in place. Well, unfortunately, the attacker got in through the authentication token and stole that token. But when they got in there, they were able to move around and gain source code, get customer visibility. They started gaining a lot more access, uh, through the, uh, internal VPN. So they knew exactly what they're doing to gain access and then spread. Um, I wish I can say this is a single-case scenario. This is back in 2022, a few years ago. Heck, you can look at, uh, Red Hat as a simple example here. Uh, third-party credential. Okta has had this example. There's even — I think, uh, it hasn't been publicly acknowledged that this is an example, but I even talked about JLR (Jaguar Land Rover) as a recent one. Um, it's just — this is public again. Uh, they've lost, and actually have still been down from a 100% operation, because they had someone take over and, uh, hurt their environment. And this is, uh, JLR. I don't know if it's, uh, across the whole United States and other regions in the world, but you can look it up. They were truly impacted by someone gaining credentials and over-elevated access, and then, um, uh, then, then they had a whole business operational challenge. So this challenge is real, and it keeps happening over and over and over, and we still haven't solved it, because there is a common weakness. It's the over-trust of identities. And that's exactly what we've been trying to solve here at Zero Networks, and we'll show you in a little bit.

So this is a, a common scenario. I've kind of talked about it, but just visualize it: an attacker gets in. It's either a phishing email. It's either a malicious application. It's either — it, it can come in through any scenario. They just gained credentials in some way. Think about your own business. If someone is at your business, and someone did gain access into your environment, on your machine, looking like you, how far could they go? That's the real challenge. If you give your red, uh, team to — uh, if you're using a third-party company to penetrate and red team you — if you give them, you, they're you, a domain admin, and you give them a, uh, machine, how far can they access and take over your whole entire environment? A lot of customers I talk to say, "Yeah, we're gonna be totally compromised, unfortunately. They're just gonna spread around, gain access and visibility." We — I'd, uh, I'd — the ideal scenario is I just kinda showed there. That would not happen. They should be challenged with the whole entire thing, and that's what the term of microsegmentation comes in.

What is identity segmentation?

Chris Boehm: So one of the key things that I wanna high— highlight: there is a lot of different solutions out there. You can now think of IAM, uh, Privileged Access Management, IGA, uh, NAC, ADM. All these are built on selling you trust. Like, they wanna say, hey, this is what you can understand, what's happening in your environment. Uh, but identity segmentation actually enforces it. That's the big difference. So instead of it just showing you the visibility and controlling access, and then having the visibility of what's going on, we're actually enforcing it, down to the port level, in comparison. So, so we deliver a strong protection of least privilege when it comes to, um, uh, over-elevated access. So think of the — I usually think of it as a service account that has to work a certain way, or an administrative account, or, or anything that you would think is gonna potentially impact your environment, not a standard user. Standard users should tend to just do what they need to do: gain access, communicate, download files within your environment. But you should dynamically understand and know things that are changing your environment. As you know, things change. It's consistent. So you have to have something that's dynamic, adapts, and grows within your environment. And that's where identity segmentation can come in and say, is this a normal connection for you? Yes? No? If it is, then, yeah, this shouldn't be blocked. This should allow communication. But if it's not, and you don't ever do this, and it should be doing — it shouldn't be doing this, let's just verify who you say you are. And it really enforces that mindset of zero trust, if you are a zero trust fan. So that's exactly what identity segmentation is encouraging on the path of — if you're looking at something, the zero trust journey within your organization — and identity segmentation is a key element to it.

So, again, what is identity segmentation, if you haven't figured it out by all my nuts and little, uh, trinkets along the way? Identity segmentation enforces it on least privilege for admin and service accounts by restricting when and where credentials should be used. Uh, it's just like a just-in-time. If you've ever done a — I just need access in this machine, it goes out and verifies. It's the same process. We do the same thing. We verify the users who they say they are. Do they have access? Should they gain access? And then it allows them to have access. This is automatic. It can revoke. It can, uh, authorize, and it's simple. It's streamlined. It's agentless, and it's automated. So you don't have to do that conversation I was doing when I was at Microsoft, constantly asking questions, reevaluating. Do you understand? Like, do you need these more privileges? This is a tool that is just learning based on what me as a user is doing, on what machine, and what access I talk to on a regular basis. It opens that up. That's normal. But if it's not normal, it challenges: hey, Chris, are you really who you say you are, and should you actually gain access to this?

How does identity segmentation stop lateral movement?

Chris Boehm: Uh, so let's break down, uh, like, how, how is identity segmentation working? There is multiple different layers when it comes to that network path. Typically, most people think about it as I've been describing it: is the east-west protection. So that's locking down lateral movement. If you think of the most common, um, attack vector within lateral movement, most people think of ransomware today. So ransomware gets on there, spreads across your whole environment, locks it all down, and then it demands a key. So that's a great way of showing, hey, if that was locked down, it couldn't spread across your whole environment. It would be contained in that bubble. Uh, the north-south protection — that's blocking network exploits, visibility. Like, um, should, should you gain access to this? There are scenarios we have with customers that even do a, um — they have their own web app, app, uh, application that just can't support multifactor authentication. They actually use us for the web portal access of multifactor authentication. And, and then that — and that's the way east-west, but there's multiple different scenarios where identity segmentation is just a, a main key part. Of course, you have to work with your firewalls and other things in your environment. We're not a one-all-be-all, but we really locked down that lateral movement aspect. And then, of course, there's the, uh, traffic and application layer that you gain visibility to within your environment.

So why ID controls and segmentation matter? Um, the main value that you typically see almost instantly, and right away, is the lateral movement. So now you have enforced granular segmentation, uh, like me being challenged across the environment, or a service account, or whatever is necessary. It's real-time. And I, I say machine speed, but it's, it's real-time based on the machine speed itself, on containment and on authorization. So if something did happen, you can push it across a 100,000 assets. We have customers in the millions, uh, for example. Uh, it, it just goes as fast as machines allow it. And then you don't have to worry about vulnerabilities, because, again, it's completely locked down and only authorizes normal communication. So customers even use us for penetration test and visibility. Hey, you have these vulnerabilities on this machine. It can't be patched. It's not something that should be done, or it's not worth it, because it could break other operations. Because we harden that asset, it doesn't, uh, actually have issues with the vulnerabilities itself. Uh, it's not solving the vulnerabilities. It's actually making it impossible the vulnerabilities to be even exposed, um, as an example. Uh, for the compliance and regulations, I — I've given multiple examples when it comes to compliance, but, um, one of the big ones is, you may — if you're working on a zero trust strategy, or CISA, or, um, certain, uh, departments and regulations for banking, um, legal, and, uh, I think airlines just pushed it recently — there is compliance regulations when it comes to segmenting your environment. Um, we help do just that. There's the audit trail visibility. There is the actual strengthening of the defenses of each asset to have challenge of that multifactor authentication. And then, of course, it helps with that compliance management itself, um, because you're gonna be doing that with your penetration testing and visibility. And then the last one is — and this, this is actually a great by-product of what, uh, microsegmentation does for you — is, we have to monitor everything in order to know how to provide that automation. So now we provide you full network mapping within your environment. What is actually talking to what? Applications, database layers, user accounts, service accounts. Then you have a centralized control policy across your whole — your own environment. And, again, because it's microsegmented down to each asset, it shrinks that attack surface. So if something was malicious, and somehow passed your 10 or 12 layers of security, it's now contained in a small bubble, versus your whole entire environment. Now, I've been preaching a little bit, uh, for, for the past seventeen minutes. I, I was gonna loop in Nick, but I think I'm gonna probably chime in a little more with Nick's session, because it's way more fun, because he's gonna talk about the product more. Uh, but, Nick, I'm a let you take over from here.

Why does identity segmentation need network segmentation?

Nicholas DiCola: Yeah. Thanks, Chris. Uh, and, uh, I see some questions in there that we'll make sure we answer at the end. Just FYI. We probably should have said that at the, at the start. Uh, but if we dive into this a little bit deep— deeper, uh, when we talk about identity segmentation to us at Zero Networks, it's not just the identity pieces. It's also the network, if you haven't kinda picked that up from what Chris is saying. So, you know, you need to restrict the north-south movement, uh, typically with some type of zero trust network access. Right? We have workers that are all over, on unmanaged devices. How do you limit what they can actually access, unlike, you know, a traditional VPN, where you connect, you have access to everything internally? Right? So ZTNA should give you the ability to say, hey, when someone connects, first, I'm verifying their identity using my identity, um, uh, provider. But once they connect, they can only connect to these certain things. Right? Unlike the traditional model of, once they connect, they can connect to everything. Um, and that's what ZTNA kinda brought to us. And that's how you enforce that north-south traffic going through your edge, out to your, uh, users — are coming from your users that are external, in through your edge. And when you — once they're in the network, right, and they connect to something, um, microsegmentation is about restricting that east-west movement. Because, again, if you don't close down the ports that are on the servers and workstations that aren't being used, you're leaving an attack vector that an attacker can use. So even if you implement all of identity controls and segmentation, you also have to layer in the network piece, because that way you close down things that aren't being used. Um, the problem is, this has been notoriously difficult in the past, uh, and especially things like privileged ports. We have to leave them open. We all are IT admins in some way, shape, or form. Uh, I'm assuming, if you're on this call, you do some type of IT administration. And, you know, you need to RDP to a server. You need to SSH to a server. You need to RDP to a client to help, uh, an end user, uh, with their machine, and that typically gets left open. And when you look at attackers, once they get in, they'd love to use privileged ports. Because if they have a credential, and it gives them privilege on the next machine, that means they can do what they want once they get to that machine, whether that's put a malware payload, whether that's gather more credentials that they can then harvest and use, uh, to laterally move again through the environment to ultimately reach their goal. So this is why it's not just good enough to identity segment, but identity segmentation to us is identity plus network, uh, segmentation in the environment.

And then, lastly, you may have seen this, uh, when we talk about up-down movement with identity segmentation, uh, in the past, where, um, Microsoft has recommended the tiered model, but many folks struggle to actually implement that. Right? And, basically, that's saying, a domain admin should never log on to a server tier, and a server admin should never log on to the domain admin tier, and, and to the workstation tier. So you, you put layers, uh, in between, to prevent identities from accessing. Of course, you're gonna have users, or service accounts, potentially, that log in to different tiers. Uh, but, you know, your users should only log in to workstations, and they should only access the services remotely that they need access to. Um, this is how you prevent the credentials from being exposed, so that an attacker can take them and harvest them and, and laterally move through the environment. Did you wanna add something, Chris? You look like you were gonna —

Chris Boehm: No. No. It's well said. Well said. I — I'm just, uh, rigging the questions. Maybe we should answer some of the questions before we do a demo, uh, just as an idea, because we already have five. But, uh, we can, we can wait until that, that slide.

How does Zero Networks segment admin and service accounts?

Nicholas DiCola: Yeah. Yeah. Yeah. Look, we can just — let's save them at the end. Yeah. Okay. Cool. So, specifically, in Zero Networks identity segmentation. Right? So now, a bit more about how our product does this. Um, we help identify the accounts, uh, admin accounts in the environment, and we ultimately give you the ability to segment them and block them from logging in everywhere. Now, I know immediately everybody's like, wait, you're gonna block my admin account from logging in? How the heck am I gonna fix everything? Um, well, we give you the ability to have an MFA policy that says, if a privileged account goes to log in to a machine, they need to MFA. And once they MFA and prove they are who they are — uh, again, you need good MFA practices here — then we allow that access to the machine. And so this limits, uh, your account from being used in ways that it shouldn't, in new places that it shouldn't be, as well as protecting it with a step-up authentication, where traditional models don't allow you to do that. So when you look at these compared to some of the other things, like, uh, a PAM, or, uh, you know, other things I mentioned, in Microsoft tiered model — the tiered model is great. The problem is, it's very hard to implement. The tooling doesn't actually allow you to, uh, implement this, and I struggled with this many, many times at Microsoft, and working with customers to implement it in their environment. It's all based on GPOs, and GPOs are very difficult. You, you can't get very granular with them. Uh, and then there's other tools, like PAM, or privileged access management, that, yes, they take the admin account in, they rotate the credential, but they're not actually blocking where that account can log in. They're somewhat controlling by saying, hey, this account is allowed to access these servers, but it doesn't actually block that account from being used. So if an attacker somehow gets a hold of their token, that account can still be used anywhere in the environment, unless it's actually blocked. It's not a zero trust, uh, type model.

And then with things like service accounts, uh, we hear typically a lot from customers: "I have no clue what service accounts are in my environment, or where they're being used, or what they actually need to be used for." Um, so this is one of our, our superpowers: is we give you the ability to automatically discover those service accounts, learn where they're used in the environment, and build rules to limit where they can actually be used in the environment — ultimately, to block them in places they shouldn't be used. So if you take something like a traditional backup account, right, it logs in as a service on the backup server, and it does a network login on all machines. But if you go look in many environments, that account just has user rights on all the machines. Right? It's not blocked on workstations. It never needs to log in to a workstation. Why does it have a user right to be able to do that? Um, so we give the ability to discover, uh, learn those, and then restrict them. So now those accounts are actually blocked from logging in to all the places they aren't used. And so if you have a service account that you're not even using in the environment, you're afraid to turn it off — then we would never learn that, hey, it's not used in the environment. It would never get a rule to allow it. So eventually you're ultimately blocking it, without even disabling it. And I think that goes to one of the questions that was, uh, in the chat here: how do we identify and eliminate dormant accounts? Again, you learn where the accounts are used, and you build rules to allow the ones that are being used, and anything that's not ultimately gets blocked, right, in a zero trust model, at least in our product. But, you know, there's other things you can do to detect that. Uh, and there's many, many different articles about how to find dormant accounts, uh, in the environment. Um, so I'm actually gonna mark that one as answered. Great question, by the way.

Uh, so just to reiterate, like, at a high level: we have a platform for solving some of the biggest challenges in zero trust. I don't say it's a zero trust platform, because you need zero trust in architecture, and you need other components to, to make up zero trust architectures. Uh, we just solved some of the biggest ones, which is microsegmentation, identity control — limiting where those accounts can actually log in to — and then the zero trust network access for your external access coming inbound, and giving you a zero trust model in all of these, uh, flavors. Cool. So let me stop sharing and share my other window really quickly. And where did Zoom go? Share. Okay, Zoom. What's going on here?

Chris Boehm: If you need me to share, let me know.

Nicholas DiCola: I think it's — I think —

Chris Boehm: There you go. It's just really big. Maybe that's your screen.

Nicholas DiCola: I'm, I'm using it on the laptop. Like, uh, it's not on my other screen.

Chris Boehm: There you go. There you go. There you go.

What does the Zero Networks portal show?

Nicholas DiCola: There you go. Cool. Uh, so when you log in to our portal in Zero Networks, uh, we give you a nice dashboard to understand kind of where you're at along your segmentation journey. So you can see all of the different IT assets, OT assets — and this is a smaller environment, uh, that we use for labbing with customers. Um, and you can see how many of my assets are kind of network segmented across the environment, how much has been identity segmented, uh, and I can see those different things. And I can click on these different links to go figure out, okay, what's not been, uh, learning that I need to start learning in the environment, or segmenting, uh, across the environment. When you're building any type of segmentation, entities is probably the most important thing. Understanding what's in the environment. What are the assets? What are the users? What are the Kubernetes clusters? Are they service accounts? Like I said, we automatically discover all of these service accounts for you, so that you can then segment them, and same with your human privileged accounts — and we have a few here — and even show you ones that are inactive, uh, across the environment. And also build groups of assets, and automatically tag assets, so that when you build rules — hey, the backup, uh, service needs to talk to all of the machines that it's backing up, and so you wanna tag that as, like, an actual backup, uh, application. So doing that automatically is what makes it very, very simple.

Um, but here in network segmentation — and again, I'm starting at the bottom of the OSI model and working up. Because if you leave the ports open, it doesn't matter if you segment the identities. There's still potentially a vulnerability that attackers can get to, and this is why we say identity segmentation is really network plus identity, uh, segmentation. So closing down the ports. And so you can see our assets here that are in learning, and we can go click on one of these, uh, applications. This is, like, a three-tier application, and we can see any rules that have been learned. So nothing specific has been learned for this application yet. Um, it was just added to learning recently. But if we go pick on something else, uh — like, where is our domain controller? Here we go. We can see the rules that were learned, uh, for the domain controller in the environment, and we can also see that, hey, it was automatically tagged as a domain controller and a DNS server, and we learned any asset needs to be able to access DNS, and, uh, any asset needs to be able to access the domain controller. And, of course, now that this asset is segmented, we have a small set of rules allowing the few things that are actually needed to function, and all of those other ports, uh, that aren't being used in the environment, um — that, you know, just never get used, or shouldn't be open — are now closed down at a network level. Right? So now you have network segmentation and microsegmentation across the environment.

Um, and the way that we build those rules is always a question for folks: is, we get visibility into each machine and all of the network connection events in and out of the machine. So we can see the user, the process, the source, the destination, and we use that to feed a deterministic automation engine that builds the rules, uh, for the environment. You can see all of those rules here. And so you could see the Oracle VM hosts can talk to the VM managers, internal subnets can talk to the Oracle VM manager, and, uh, VM host to VM host, they need a few ports. So, again, we learned all of those things. We tagged all of those assets — uh, just an example here, for Oracle VM, uh, solution — that you didn't have to go build those rules. We automated building those rules. Now, if we go to those hosts and actually look, there's probably a ton of listening ports, but the only thing that's allowed is a very select set of ports that are needed in the environment for the application to actually function. So you've closed down all of that capability for the attacker to be able to laterally move at a network layer, um, there. And if you remember, I talked about protecting privileged ports. We never open privileged ports by default. We build an MFA policy that says, hey, if any user, uh, using any process wants to connect to a segmented asset on RDP, for example, they must pass, uh, one of the MFA options. And if we scroll right here, we can see we have Duo Push and Browser and a few others, uh, automatically configured. So we can integrate with what— whatever MFA provider you use. So now you can step up that and make sure that's a real human that's doing that MFA.

Now, moving up in the stack to identity: we talked a little bit about identifying all of the service accounts. This is where customers really struggle, of, like, hey, what's my service accounts? Where are they actually being used? And what we do is, we discover those service accounts. We also collect login activities across the environment, so we can see where are these accounts being used — even the regular, uh, user accounts you'll get visibility into, um — and all of your privileged accounts: where they log in to, what type of login are they doing. And then we can feed that into our same automation engine to build rules, such as, hey, this ZN service management — which is actually the Zero Networks, uh, service account, because we do all of this without agents — um, needs to be able to log in to every machine at a network layer, uh, or network logon. So that means, because it's allowed here, and there's a, a rule that says down here that any segmented service account, uh, to all assets is blocked for all of the other types, um, that this account can only do a network logon on every machine. That means, even if I go to a machine, uh, and try to log in interactively with that account, it's blocked by default. Right? So it's not allowed, because it's using a deny model to deny that account access, and only allow it in the places that, uh, it needs to log in. So you can imagine, if you have — we talked about a backup service — we can learn, hey, that backup service logs in on the backup server as a service account, uh, or service-type login, and then logs in to all the servers as a network. That would be allowed for that, but then it would be blocked everywhere else. So this is how you prevent service accounts from being used in inappropriate ways. Uh, it's amazing how often we find with customers: developers, and, and users, using service accounts to interactively log on to machines, um, or just — even just use them for their day-to-day activities, because it has more privilege. So it makes their job easier. So they just use that account, uh, to do what they need to do.

Now, for the privileged accounts, we also discover those, and you can segment those accounts. So we can see we've segmented Ken's account here. And by default, we don't allow it anywhere. We have a rule that says, hey, any, uh, segmented privilege account is blocked everywhere. But we have an MFA policy that says, hey, if a segmented privileged account tries to use a network login, or a, uh, RDP, or interactive login, then they will be prompted for MFA. And when you combine these, you can MFA at the network and identity layer once, and get access both at the network layer, for things like RDP, and your login, uh, capability, all combined into one. So it makes it very simple, uh, at a high level, to see, uh, or to block and segment across the environment, because you don't have to deploy agents. It automates building all of the rules for you, uh, and then you can segment those accounts across the environment. Alright. So let me jump back, uh, to the deck there. And let me know when you see that, Chris.

Chris Boehm: I see it.

What happens when an attacker lands on a segmented machine?

Nicholas DiCola: Cool. Um, so now, if you take Chris's visual from earlier: if an attacker gets in, gets to a machine — somebody goes through a drive-by website, they click on a spear-phish, they're on that machine — and they start going across the network and trying to poke, uh, into other machines, and everything's closed down, how are they gonna laterally move at a network layer? They can't. But let's say there is something open — a regular user application that they need, need to access — they can't laterally move to using some credential on the machine, because the machine won't have the credential that can be exposed. So that service account wouldn't be, you know, able to log in the machine, where they could then get the credential and, and use that service account. So if you were able to do this, uh, one compromise now equals none compromise, because the attacker is not able to, to laterally move through the environment. Uh, so just to highlight some of the things that, that we do to make it really, really simple, um, compared to some of the legacy solutions that are out there: um, because we're agentless and, and automated, it takes months for deployment, not years, uh, for deployment, uh, so you can get segmented in a very fast way. And it also doesn't require a ton of human resources to, to go do that. Um, plus we cover — like I said, with identity segmentation, for us, it's network plus identity, uh, and privileged ports and things like that. So it's a little more than just regular identity segmentation or network segmentation. It's the two combined that make it super powerful and important, uh, in what we call holistic.

Chris Boehm: And to, to clarify really quickly on the deployment: it's fully deployed. Like, we have customers that are fully deployed in months. Not just, hey, we have it up and running, it's 30%, it's hitting the key assets. No. They fully segmented their whole entire bank, or infrastructure itself. Uh, so it's a huge success factor for us.

Nicholas DiCola: Yeah. And then, just to share some, uh, customers, and, more importantly, uh, as the VP of customers, I, I care about the, the CSAT score and Gartner Peer Insights. Right? Like, the customers that find this very useful, uh, in up-leveling their security posture, to be able to really stop an attacker from spreading. Um, because, ultimately, my favorite saying is: if an attacker gets in your house, and all the doors are locked, and they can't go to any room, where do they go? They leave, and they go to the next house down the street, where they can do that. Well, imagine that's the same for a corporation. If an attacker gets in, and they can't go anywhere, and all they can get is that one laptop, they're going to leave and go somewhere else. They're operating on ROI as well. They wanna get the most impact for their money, um, and they're gonna go somewhere where they can laterally move in a very easy way. So, first, I wanna thank everybody for coming, and we do have a few minutes left, which is great. So — because there's lots of great questions here, and, uh, I don't know where you wanna start, Chris, but, uh, we can start.

How does identity-based security change the overall architecture?

Chris Boehm: I can start from the top. I mean, uh, so — sure. The, uh, first one we kind of already answered. I'll just read it out for everyone. I don't know if you can all see the question. So: how do — how does the shift from network-based security to identity-based security change the overall security architecture? Well, Nick kinda already highlighted it. Um, I, I would say it — it's not a full — you're removing network security. It's a mix of identity network security with, um, merging together. So you're using the identity to manage the network security layers, uh, within your architecture. So it's just — instead of it just being, hey, your network is hardened — um, because I've heard customers: "Oh, I have a fully locked-down golden machine, and there — nothing can happen to it." Well, unfortunately, you still have to communicate with it, unless it's truly just a, a box that doesn't do anything but talk to itself. Um, we enforce that layer of, uh, elevating privileges, and controlling the privileges automatically, based on that access of that machine itself, including the service accounts that are leveraging that asset. You have anything to highlight there, or no?

What's the biggest challenge in enforcing least privilege at scale?

Nicholas DiCola: No. I think it's a great answer. I think the next one kinda rolls into that as well, and I think, uh, I can take that one, which is, uh: what is the biggest challenges organization faced when implementing least privileged access at scale? Uh, the biggest challenge is we don't know what accounts are what, or what's active and being used anymore, and building the rules. Right? Um —

Chris Boehm: Yep. Yeah.

Nicholas DiCola: Sorry. Distraction here. I saw in the chat, Oorah. So, Oorah, uh, Semper Fi, whoever that is in the chat there. But, um, you know, auto— you need automation to help you learn what's being used in the environment. Without that, you're gonna spend years analyzing data, trying to figure out what's logging in where. I know, by the time you finish the first one, it's already changed, and now you need to go back and fix it. Uh, so ultimately, you need automation to really help you to, uh, get over those challenges.

Does continuous verification hurt user productivity?

Chris Boehm: Yeah. I mean, he, uh — Nick showed a great slide where he said less than one full-time employee. I mean, the, the bank example: they have one guy that comes in, checks once or twice a week. He says he spends fifteen to thirty minutes, and just sees if there's any new rules that were learned, and then he verifies and connects. If there is any request or challenges or network development, it's a simple, hey, um, this is something new we're adding to environment. They do the per normal process change control. So it just kinda helps with that flow of communication. Uh, it makes it real easy, instead of learning everything in your environment every day and, and dealing with that. So, um, I, I can answer the next question: how do we, uh, continuously verify identity and context that are harming user productivity? The key difference is, you could technically do it for everything in our environment, but we do it on privileged, privileged ports and privileged activities. So the normal user, like I mentioned, you're not, you're not gonna be — they won't even notice their networks is there. They're just gonna be like, "Oh, this is great. I mean, I can't — I'm still communicating. I'm getting my email. I'm doing everything." That's normal. It's when someone is trying to do administrative actions, or privilege-elevated actions, that you're gonna really start noticing the difference, uh, outside of each asset. So if I'm on a machine, I'm trying to remote into a server, database, application, whatever is outs— outside of that asset, the east-to-west traffic, that's when you're gonna notice the productivity difference, and it's, it's just the multifactor authentication challenge if it's not a normal communication, to be clear. We learn the normal behaviors. So —

Won't an attacker just stay on one laptop?

Nicholas DiCola: So I, I scroll down, because there's, like, so many good questions, and I feel like we're not gonna get to answer all of them. Um, but here's a great one. It's, uh: if the bad actor gets to one laptop, won't they stick to it and, uh, so they can later try again? Maybe. But if you're segmented, I come in the next day, I still try to go poke those network ports. They're closed. Where am I gonna go? I still can't get an identity that laterally moves. Again, uh, you know, they're going to get up and leave. They might be able to get access to something the user has access to. So, again, you still have to control authorization at various levels, uh, of the applications, to say what users should be accessing that application. But, ultimately, they're only gonna have what that user would have access to. Because if they can't get a credential, because you're not exposing it to the machine, then they can't laterally move with a credential that has more privilege on the next machine. Um, and, ultimately, if the network ports are closed, they can't connect to those things, even if there's no vulnerability in them. So, great, great question there. Uh, I'll hit — yeah. Amazing question. I don't know if you scroll down to pick a different one.

Does Zero Networks work in cloud and hybrid environments?

Chris Boehm: Uh, scroll down. I'm gonna answer Scott's. I'm just calling him out, uh, because he didn't do it anonymous. Uh, so there's two questions. Both are kind of the same. Um: how do we expand into cloud infrastructure, like Entra ID, and on-prem Active Direct— is on-prem AD required? And then the other question was: do we support hybrid deployments, including multi-clouds? Kind of the same question. Uh, I wanna mark them both answered. So we do work in any infrastructure design. Um, now, the — it depends on how you talk about it. Like, the mesh framework of network security groups, that is still managed by the cloud portfolio, and we are looking at expanding in that ecosystem, when, when it comes to microsegmentation. But we do work with cloud workloads, hybrid workloads, um, and on-prem. So we don't really care where the assets are. We just need the communication to, uh, allow the, uh, the agentless approach. Now, you can — we do have an agent. Uh, we do say we're agentless. But if you need something that's an an offset, or just you wanna deploy an agent, it's easier, we do have that approach as well, where we don't really care where it's at. It could be with a BYOD user, or whatever. Um, so there's multiple different scenarios we do support when it comes to, uh, managing and getting your access and ecosystem. Um, some of the largest customers, where they do a mixed approach — like, they just mass-spread agentless, and then certain assets, they'll do agents, because it's just easier. So —

How does Zero Networks compare on price and maintenance?

Nicholas DiCola: And cool. Let's do one last one. Uh, I think this is a great one: the issue with microsegmentation, uh, data segmentation, is price and maintenance. Uh, would you please compare Zero Networks with similar products? So, I mean, at a high level, there — this is one thing I struggle with every day: is that lots of customers have a stigma that microsegmentation is very hard and it's very expensive. Uh, and that's true with many of the kind of other solutions that are out there, because typically they're hardware-based, or you — more importantly, you have to manually build rules. The key to any segmentation, um — whether that's, uh, microsegmentation, identity segmentation — is you need automation to help you. Right? Automation should build the rules that you can then quickly validate. Yes, this account should log in here. Yes, these machines need access to this application. You validate that, and then you can segment in a very quick manner. You shouldn't have to build the rules yourself. That is the biggest difference with Zero Networks: is we automate building all the rules, so you can do a very quick validation, and we give you quick tools to be able to validate in a, in a, um, very fast way that, hey, this is ready for segmentation, and I can segment that. So, uh, great question. I'll mark that one as, uh, done as well. And, uh, yeah, I just wanna say thanks again for everybody attending, because we're, we're at time here, and, um, thanks for all the great questions. If we, we didn't answer your question, feel free to reach out to us. We're happy to help answer the question. Uh, you can find us both on LinkedIn. Um, I don't know if you're on Twitter. I'm on Twitter as well. Uh, I guess it's now, it's X. Sorry. Uh, I'm sorry.

Chris Boehm: Maybe we're wrong.

Nicholas DiCola: So — yeah. Yeah.

Chris Boehm: Alright. Spend billions of dollars for that.

Moderator: And with that, we'll go ahead and close out. Thank you, everyone, for attending our webinar today. We hope you enjoyed it as much as we did. If you registered through ViB with your business email and you have any questions, please contact webinars@vib.tech. Thank you again, and have a good day.

Nicholas DiCola: Bye, everybody.

Chris Boehm: See you, everyone.