Leave Hackers Stranded and Penniless in 2025

Summary

Nearly every major attack of 2024 shared a root cause: once inside, attackers could move laterally because networks were too open and accounts too permissive. In this webinar, Zero Networks VP of Customers Nicholas DiCola explains why automated microsegmentation is the cornerstone of zero trust, and how it enhances cyber resilience, ensures operational continuity, and accelerates compliance by closing unneeded ports and protocols and putting just-in-time MFA in front of privileged access. Aaron Goodwin, CISO at B. Riley Financial, shares how his team reached about 95% segmentation within a few months, now passes pen tests that it used to fail, and spends about two hours a week managing the platform.

Key takeaways

• Lateral movement is the common thread in major attacks: in incident response, attackers typically go from an initial laptop to domain admin in 48 to 72 hours.
• In a VIB survey of IT and security professionals, ransomware and phishing topped the list of concerns for 2025, and 99% rated zero trust as at least somewhat important.
• The CISA Zero Trust Maturity Model’s optimal network state calls for fully distributed ingress and egress micro-perimeters with dynamic, just-in-time connectivity, which automation makes achievable.
• Zero Networks monitors assets agentlessly, tags and groups them automatically, builds rules and MFA policies during a 30-day learning period, then enforces them through native controls; one customer saw about 3,000 rules built in a month.
• The RPC Firewall limits domain controllers to the RPC functions they need, and identity segmentation restricts service accounts to the assets and logon types they use.
• B. Riley Financial now passes its pen tests, onboards new assets automatically, and calls the platform close to set-and-forget.

This webinar was recorded in December 2024.

[00:00] Moderator: Hello, everyone, and welcome to the webinar “Leave Hackers Stranded and Penniless in 2025,” led by our very own security Jedi and VP of Customers, Nick DiCola. Over to you, Nick.

[00:30] Nicholas DiCola, VP of Customers, Zero Networks: Thank you, and thanks, everybody, for joining today. I’m Nicholas DiCola, and we’re going to talk about how to leave hackers stranded and penniless. If we were in a room, I’d ask everyone to raise a hand if they want to achieve that, and I’m sure everyone would, because we all want to stop attackers from being successful. So let’s talk about why they’re successful and how you can solve that with some game-changing technology.

What did the major attacks of 2024 have in common?

[01:00] Nicholas DiCola: If we look at 2024 in a nutshell, the list of attacks goes on, and these are only the known ones. There are probably many more. For example, there was Change Healthcare, at UnitedHealth, where a ransomware group leaked data from 300 million patient interactions. Hacks continue to occur, and I think everybody’s aware of that. Ransomware in particular remains the type of attack attackers use to hold companies hostage and make money.

[01:33] Nicholas DiCola: So why does that happen? I often show a video of a woman running freely through an open field and ask people what it looks like to them. I get answers like, “It’s someone enjoying the great outdoors.” And I say: no, this is what an attacker feels like once they’re in your network. When we look at the root cause, networks are too open, with too many ports and protocols available for attackers to move laterally, and accounts are too permissive, able to log on to too many places. Once an attacker gets in, they use those open ports and protocols to connect remotely and move laterally throughout the environment.

[02:34] Nicholas DiCola: When I did incident response work in the past, we typically saw attackers go from initial landing on a laptop to domain admin in less than 48 to 72 hours. They spread through the network very quickly, and especially in Active Directory, once they get one domain admin credential, they can get to almost everything. If they’re a ransomware group, they can start setting up scheduled tasks to launch ransomware at a certain date and time. Hopefully your EDR catches them before then, but clearly, from the news, that often doesn’t happen. Most of these organizations had EDR and other tools, and they don’t always catch everything.

[03:06] Nicholas DiCola: When we analyze these attacks, the common theme is lateral movement: spreading through the environment with stolen credentials, a lack of MFA on administrative accounts, or too much of the network left open. Lateral movement is ultimately the root cause of all of these attacks. Yes, there’s an initial compromise, like spear phishing in the MITRE framework, but imagine what your life as a defender would be like if an attacker got in through spear phishing and then couldn’t go anywhere. They’d just be stuck. Some of these attacks were actually preventable: if the organizations had implemented a few capabilities, like MFA on internal accounts, they could potentially have stopped the attackers from spreading.

What are IT and security teams most worried about going into 2025?

[04:08] Nicholas DiCola: At Zero Networks, we worked with a partner, VIB, to conduct a survey of IT and security professionals about their biggest concerns going into 2025, along with a few other questions we’ll cover here. Ransomware and phishing continue to be the top two concerns. Phishing is easy and very successful, so it’s typically how the initial compromise happens. After that, lateral movement lets attackers spread through the environment and inject ransomware to launch at a certain time.

[04:39] Nicholas DiCola: People don’t think as much about lateral movement, because lateral movement itself doesn’t shut the business down; the ransomware does. We saw a couple of big ones with gaming companies recently. One paid and got back up and running quickly. The other didn’t, and it took much longer to recover. So if ransomware locks out your entire environment, you’re in a hard place: do you pay to get back into business, or take the risk of not paying and let the business suffer a longer recovery? It’s not an easy choice, and I understand why this is a top concern.

Why is microsegmentation the cornerstone of zero trust?

[05:42] Nicholas DiCola: We also asked how important zero trust is for improving overall security posture, to help prevent ransomware, phishing, and other attacks. Basically 99% said it’s at least somewhat important, with most saying very or extremely important. People know it’s important, they want to do it, and they know it will improve their security posture.

[06:12] Nicholas DiCola: And microsegmentation is really the cornerstone of a zero trust architecture. At the network level, if you don’t microsegment, you can’t really have a good zero trust architecture to start with. Zero trust is the concept of blocking by default and allowing only what you actually need. Think back to the OSI model, for those of us who learned it many years ago: seven layers, from physical up to application, with the network near the bottom, and you have to work your way up. If the network is open, it’s much harder to reach a zero trust architecture. If you’re only doing it through identity, for example, you still need network blocking as a starting point.

Why do microsegmentation projects so often fail?

[07:14] Nicholas DiCola: So we asked the same respondents about their key concerns with microsegmentation. There was a long list: complexity, disruption to existing operations, dealing with legacy applications, implementation costs, and more. You can summarize them in a few big buckets: it’s a never-ending deployment that takes a very long time, confidence in success is low because the level of effort is very high, and while the security posture you get is very high, all that work makes the ROI low. So maybe you focus on something else with a higher ROI, meaning less effort, even if it raises your security posture only a little.

[07:46] Nicholas DiCola: Even Gartner has said the failure rate for network segmentation projects is high, and that most projects last longer than the average CISO’s tenure. That means the project likely doesn’t even finish if you, as the CISO, are driving it. But it’s not all bad news. We have a game changer at Zero Networks, and the way to really do this is automated microsegmentation. Automation shortens the deployment cycle and increases your ROI, because your level of effort goes down. If an automated capability microsegments your network and you don’t have to do the work, you can actually achieve microsegmentation. And then you can enhance your cyber resilience, ensure operational continuity, and, depending on your requirements, accelerate compliance.

How does automated microsegmentation enhance cyber resilience?

[09:19] Nicholas DiCola: Let’s look at enhancing cyber resilience. Take the CISA Zero Trust Maturity Model: it has five pillars, cross-cutting capabilities that span all of them, and maturity levels within each pillar, from traditional to optimal. We know the network pillar, with microsegmentation, is the cornerstone of zero trust. I’ll read CISA’s definition of the optimal state for network segmentation verbatim, because I like the wording: the agency’s network architecture consists of fully distributed ingress and egress micro-perimeters and extensive microsegmentation based around application profiles, with dynamic, just-in-time and just-enough connectivity for service-specific interconnections.

[10:20] Nicholas DiCola: They’re basically saying: microsegment the entire network, inbound and outbound, so you allow only the traffic that’s needed, and wherever you can, use dynamic, just-in-time or just-enough connectivity so access opens on demand. If you only use a network connection on the first day of every month for a batch job, maybe it shouldn’t be open all the time. When you read that, you might think, “That’s a lot of work. How am I going to achieve it?” Automated microsegmentation is how. If automation builds all the rules for those ingress and egress micro-perimeters, and you have dynamic, just-in-time capabilities to layer MFA onto privileged ports and protocols, you can reach that optimal state very quickly, with very little effort.

How does microsegmentation ensure operational continuity?

[10:50] Nicholas DiCola: Now for operational continuity. In the attacks we discussed, the attacker gets in, reaches one machine, spreads using a credential, and the next thing you know, they have access to everything in the environment. But if everything is microsegmented, an attacker who gets in can’t spread laterally. You achieve operational continuity simply by making sure the attacker can’t spread. Think about that: if an attacker compromises one laptop and can go no further, how much easier is your day as a defender than if they spread ransomware to everything? Very different outcomes.

How does microsegmentation accelerate compliance?

[11:52] Nicholas DiCola: On compliance, frameworks like ISO 27001 and PCI DSS all require some type of network segmentation or microsegmentation. Even if it’s a corner of your network, say, PCI servers you need to microsegment for compliance, if you can do it in an automated way without breaking any applications, you can accelerate compliance very quickly by closing all the unneeded ports and preventing lateral movement.

How does Zero Networks help reduce risk and cost?

[12:23] Nicholas DiCola: The biggest thing Zero Networks does, to reduce risk, drive resource and cost efficiency, and enable the business, is automated microsegmentation, so you don’t have to spend the time. We tell people we can implement in 30 days: you add assets to learning, walk away, do a light rules review at the end of the 30 days, and then your assets go into segmentation. If you did this manually, it would take lots and lots of effort for that high security value. Now you get the same high value with very little effort, because every host on the network has its ports and protocols closed except for the few things it needs.

[13:23] Nicholas DiCola: Look at the risk outcomes. You can stop ransomware: an attacker who gets in can’t spread laterally, so maybe they can ransom the one laptop they started on, but not everything. If you’ve failed pen tests over and over, because a pen tester is essentially a legitimate attacker who moves laterally across the environment, now you can pass, because they can’t move laterally. And you can reduce exposure by adding MFA to everything with our just-in-time capability, limiting where attackers can spread. Automated microsegmentation also helps on the compliance side, by quickly building the rules you need to segment compliance-related assets.

How does Zero Networks automate microsegmentation?

[14:23] Nicholas DiCola: Let’s talk about how we make this very simple. We have a cloud service that hooks into all of your assets through what we call a segment server, which you deploy in your environment, in the cloud or on premises. It collects network and logon metadata across the environment, which gives us visibility; we call that monitoring the assets. Once assets are monitored, you add them to learning. During learning, we do a couple of very important things. First, we tag assets so you don’t have to do it manually. We recognize thousands of commercial off-the-shelf applications and group those assets together so they can be used in rules. Then we automatically build the rules and MFA policies for you.

[15:27] Nicholas DiCola: Imagine building the rules for just one application. On average, we see 10 to 15 rules per group of assets of an application type. Now multiply that by a hundred applications in your environment. One customer told me that after they turned us on and ran learning, we built 3,000 rules in a month. Even if they had all the data, they couldn’t have written those rules themselves in 30 days. So automation is key: building all of those rules and tagging all of those assets during learning, so you don’t have to, and can actually achieve microsegmentation.

[15:57] Nicholas DiCola: At the end of the learning period, we segment those assets. We push the policies into the native controls built into the operating systems and assets in your environment, which lets us segment all traffic and access. Anything that requires privileged access is protected by default with just-in-time MFA through your existing identity provider. So if someone wants to use RDP or SSH, they have to complete MFA to get access, and that access is temporary and removed after a period of time, so there’s no long-term standing access. Remember the attack patterns we discussed: if an attacker gets in and can’t connect to anything with privileged access, how will they move laterally? They can’t. They’re stuck, and they’ll leave for somewhere that isn’t microsegmented. We also add other capabilities for holistic segmentation, like segmenting RPC traffic, which you typically have to leave open and attackers love to use against domain controllers. We can segment it at layer 7 to keep attackers from using it to reach domain controllers.

How did B. Riley Financial get segmented and pass its pen tests?

[16:59] Nicholas DiCola: At this point, customers often don’t believe this is actually possible with automated microsegmentation. They think back to the complexities: it might break something, or it won’t achieve the goal. So let’s hear what a real customer says. I had a prerecorded conversation with Aaron Goodwin, CISO of B. Riley Financial. They’ve been a Zero Networks customer for two years and quickly reached 95% segmentation, I think in under a few months. One of their biggest concerns when they started was that they failed every pen test, which is ultimately a simulation of an attacker. Now, with Zero Networks, they pass their pen tests again and again.

[18:00] Nicholas DiCola: Aaron, thanks for joining us. How long have you been using Zero Networks in your organization?

[18:00] Aaron Goodwin, CISO, B. Riley Financial: We’ve been on Zero Networks for a little over two years now, and I really love the experience.

[18:30] Nicholas DiCola: Are you mostly segmented? Did you get segmented pretty quickly? How did that go?

[18:30] Aaron Goodwin: Right now we’re at around 95%, because we’re moving from Windows 10 to Windows 11. It didn’t take long at all. Assets move from learning to segmentation quickly, and the rules the tool automatically creates are really good. We go back and monitor them from time to time, but they’re very effective.

[19:00] Nicholas DiCola: As a chief information security officer, one of your top concerns is getting value out of security products, whether you call it real-world value or ROI. How did you measure that, and what was important to you when looking at Zero Networks?

[19:00] Aaron Goodwin: The biggest thing for us was that we were running an automated penetration testing tool at the time and finding gaps. We have a very complex environment, so it was hard to close the holes the tool was finding. During the proof of value, we put about 25 machines through learning and into segmentation, then tested the tool against those systems, and we couldn’t get anywhere. We expanded from there and brought in a real pen tester a couple of times to test the internal attack surface, and they also ran into major roadblocks because of Zero Networks. That was a big win for us, because of the ransomware protection it provides by locking down administrative ports, the things that get abused in these situations.

[20:01] Nicholas DiCola: It’s funny, a CISO once told me, “I’m looking forward to deploying your product, because once I pass my pen test, I’ve achieved all my CISO goals, and I can retire.” Every CISO wants to pass a pen test, and every time, there’s always something. If you had to estimate, how much effort does your team put into managing Zero Networks day to day?

[20:31] Aaron Goodwin: Nowadays, probably two hours a week at most. We go in to do some health checks, and maybe a little investigation if somebody’s having a problem. I always go there first, because it’s our first line of defense internally. We’ve been successful with it, and it’s really reduced the burden on our team.

[21:02] Nicholas DiCola: What I like to call day-two operations matters a lot to customers: they buy a security product and ask how much time it will take from the team, and new assets come online all the time. How easy is it to scale out to new assets in your environment?

[21:02] Aaron Goodwin: Very quick. I mentioned the Windows 11 situation. We’ve set up automated rules in the system so that new machines go into monitoring automatically and start the learning process immediately. Right now, learning is set to 30 days, and then they automatically go into segmentation. During the proof of value, we did that manually, but now it’s all automated, so as we continue to grow and scale, the product scales with us.

[21:32] Nicholas DiCola: Another customer told me it’s a very set-it-and-forget-it product, which is a good thing to have now, when people are overloaded with the number of tools they run. Last question: what have you seen in terms of support and innovation from Zero Networks over your time as a customer?

[22:02] Aaron Goodwin: I think about it this way: a lot of big companies, especially during COVID, let go of qualified engineers who had been there for years and knew the products really well, and we suffered as customers from the lack of support. What I’ve seen with Zero Networks is qualified engineers every time; everyone I’ve been introduced to has been very technical and knowledgeable. Support is very quick to respond to any questions or issues we have. Our onboarding process was super smooth, probably one of the best we’ve ever had. And the new features that have come out, like RPC segmentation, Zero Networks Connect, and identity segmentation, are really helping to secure customer environments.

[23:06] Nicholas DiCola: Taking it past microsegmentation to holistic segmentation is our goal, to really stop attackers from spreading. Thanks for joining us, Aaron, and for sharing your thoughts.

[23:06] Aaron Goodwin: Always a pleasure.

How does the RPC Firewall work, and does it disrupt operations?

[23:37] Moderator: We have a few questions. First: we have to keep our RPC ports open for the domain to function. How does your RPC firewall work, and does it disrupt operations?

[23:37] Nicholas DiCola: Great question. At the network level, you have to leave RPC open. And within the RPC protocol, there are about 2,000 functions that are open and available to anyone who can authenticate. A simple example is remotely scheduling a task on a server. That doesn’t need to be open from every client on the network, especially against a domain controller; nobody should be able to schedule tasks on it remotely over RPC. Our RPC Firewall is a layer 7 firewall that looks inside the protocol. We learn which RPC interfaces and operations, out of those 2,000 functions, are actually needed, and close the others that aren’t needed or shouldn’t be open from every client or server in the environment. So there’s no impact on your Active Directory operations; we just limit the RPC functions, so the ones that shouldn’t be used aren’t available.

How accurate is Zero Networks’ automated asset tagging?

[25:10] Moderator: Next: we’re currently tagging assets manually, which can cause issues when we group them. How do you automate this process, and how accurate are the policies?

[25:10] Nicholas DiCola: I like to tell people we’re about 99% accurate. There’s always something that could be missed with any learning in any environment. When we learn and tag assets, we look at many things: which processes are running, which users are running them, and which ports and protocols they use, and whether those connections are actually established, because just because something is listening doesn’t mean it’s used, and you may not want to open it. We tag and group assets very quickly during learning, so you don’t have to do any of that work. And if you add an asset later, you just put it in learning, and it gets the same tags, joins the same group, and gets the same rules. We take all of that work off your plate, so you don’t have to worry about manual tagging or someone missing something.

How does identity segmentation complement microsegmentation?

[26:11] Moderator: One more: how does identity segmentation come into play? What is it, and how does it complement your microsegmentation offering?

[26:42] Nicholas DiCola: Identity segmentation is the next level of segmentation. Back to the OSI model: if your network is open to an application, you then need to segment the identities logging into it. Do they actually need to connect to that server? For example, a service account might only need to access three servers, but by default it can typically log on everywhere, and nothing blocks it unless you specifically build policies, which is very hard to do. With our identity segmentation, we discover all of your service accounts, and you add them to learning. We learn where they log on, what type of logon they use, and for which applications, and then automatically block them everywhere else, so we don’t break the application, but we do stop the account from being used where it shouldn’t be. For example, a backup account that reaches out to all your servers has no reason to log on to your clients, so we block that and allow it to log on only to the servers it needs, with only the logon type it needs. It’s automated identity segmentation on top of network segmentation, for the next level of holistic segmentation.

[27:45] Nicholas DiCola: Thank you all for attending. Please reach out to us through our website with any questions, and we’ll follow up. Take care.