Stop Lateral Movement, Start your Weekend

Summary

Security spending is up, yet breaches and their costs keep rising, because detection-first defense can't stop an attacker who moves laterally in under a minute. At Containment Island, Zero Networks co-founder and CTO Amir Frankel and VP of Customers Nicholas DiCola walk through real-world breaches. These include a ransomware gang that used a webcam to bypass EDR and the 2024 MITRE intrusion. They explain how automated microsegmentation finally makes containment practical.

Key takeaways

• More spending hasn't meant fewer breaches. Cybersecurity spend has risen 43% since 2021, yet reported breaches and the cost per breach have both gone up.
• Detection is too slow for modern attackers. Identifying a breach takes about 194 days and containing it about 70, while CrowdStrike measured a 51-second breakout and about 20% of ransomware attacks start exfiltrating data within an hour.
• Attackers route around EDR. In one real case, a ransomware gang blocked by EDR pivoted to an unsecured webcam and used it to encrypt the server it originally targeted.
• Microsegmentation stops the chain. Closing unused ports removes the paths an attacker needs. MITRE's CTO called for MFA and microsegmentation after its 2024 breach, and B. Riley Financial went from failing pentests to passing them.
• Automation closes the gap between belief and adoption. Most IT professionals say microsegmentation is a must, but few have done it. Zero Networks automates asset tagging and policy creation, keeps privileged ports closed behind just-in-time MFA, and runs as software only, at a fraction of the cost of legacy approaches.

Speakers: Moderator · Amir Frankel, Co-founder and CTO, Zero Networks · Nicholas DiCola, VP of Customers and Security Jedi, Zero Networks

Moderator: Hello, everyone. Welcome. Thanks for joining today's session, session 11 of Containment Island. So we're almost at the end. Tomorrow is our final session. For today, we're very excited to have Zero Networks' own Amir Frankel, our co-founder and CTO, as well as Nicholas DiCola, vice president of customers and security Jedi. So you've heard from Nick a few times, but we haven't heard from Amir yet. Um, very happy to hear their presentation. And, basically, it's all about — uh, they're going to unpack some real-world breaches, talk about EDR blind spots, and, of course, the power of proactive network segmentation. So with that, take it away, Amir and Nick.

Who are the speakers?

Amir Frankel: Really glad all of you could join us today. Uh, we came here today to talk to you about how to stop lateral movement and start your weekend. It's time to shift power to the defenders. I would tell, like to tell you that our session today is gonna be interactive. We'll have some polls in the middle, and, of course, we'll have some Q&As in the end. So, uh, I'm the co-founder and CTO of Zero Networks. I have twenty-plus years of experience in deep tech. I'm a big believer in simplicity, and that simple is always the right answer, that you should never compromise on quality or take any shortcuts. Nick, over to you.

Nicholas DiCola: Thanks, Amir. So good to meet you all. I'm Nicholas DiCola, the security Jedi here at, uh, Zero Networks. I've been in IT and security for twenty-five-plus years. I'm very customer-obsessed and focused, uh, on solving hard problems with customers, and I have numerous books and certifications. Uh, so let's dive in.

How much have networks grown?

Nicholas DiCola: So when we first take a step back and just kinda look over the last few years, what has happened to networks? Modern networks have just outgrown flat infrastructures of the past. I mean, I remember my days, we used to walk in. We had a network switch. We just plugged in a new computer. If there was a new computer, we plugged in. But now it's all growing into Kubernetes containers, cloud, hybrid architectures, identity sprawl across SaaS applications. So many, many different things are getting interconnected in various different ways. OT assets, IoT assets — all of these things continue to outgrow, uh, the, the, the older networks of past, to say.

So we'll start with our first poll. Uh, how much do you think your network has grown in the last three years? Like, have you seen a very large increase in your network growth? Uh, so please interact with the poll and let us know here how you feel your network has grown in the last few years. And we'll give it a few seconds, uh, before kind of displaying the results. Alright. We have zero, zero, uh, submissions. Now it's going up. Here we go. It just takes a minute. Uh, so we're up to a few percentage, 20%. Nice. Nice. Keep going. We'll give it just a few more seconds. Um, Amir did warn you it was a bit interactive. Uh, so we'll have a couple polls along the way. So we appreciate any interaction here. Alright. So we got about 45%, uh, just to keep things moving here. We'll go back and take a look at the results. So most folks think, you know, their network has grown somewhere between 0–25%. That's a significant growth. Right? If you think about, uh, hey, I have 100 assets, and it grows 25 — that's another 25. Well, imagine you have 10,000 assets, and it grows 25. That's 2,500 more assets. And those assets could be, again, cloud resources. They could be, uh, on-prem assets, OT assets, all of these different things, uh, across the environment.

Why isn't more security spending stopping breaches?

Nicholas DiCola: So we have these modern networks that are growing, and our security investments haven't curbed our cyberattacks. We see on the left here that 215,000,000,000, uh, was the number for spending on cybersecurity, and that's up 43% since 2021. It's quite a bit of an increase in the last few years. We can see the attacks have gone up, almost to 9,500, uh, data breaches — and these are only the ones that are reported. Right? What about all the ones that are unreported? And that's an increase of 660 since 2021, in the middle. And on the right, you can see, hey, we're spending more per breach, of an average of 4,800,000.0, which is up 15% since 2021. So we're spending more on cybersecurity, but yet the breaches are going up, and the cost of each breach is going up. That math doesn't add up. When you spend money on cybersecurity, your hope is that, hey, the data breaches would go down, and the cost of the breach would go down, because I have more capability, more tools to stop the attacker and contain the attacker in the environment.

How fast can you contain an attack?

Nicholas DiCola: So let's jump into one other poll. So here: how long do you think it would take you to contain an attack in your environment? Like, if an attacker got in today in the environment, how fast do you think you could respond and contain them inside of the environment using your existing set? So we'll give it a minute here to, um, for some folks to submit. So we're up to about 50%, uh, response. So first, thanks for responding, and let's see what the results look like. So, yeah, pretty close. Most, uh, think it's a half day, but, uh, quite a few right behind that think it's a, a full day, uh, or longer. Sorry. Um, so, yeah, like, it's very hard to contain an attack when an attacker gets in the environment and really stop them from, uh, spreading laterally. So I'll turn it back over to you, Amir.

Why is detection-first defense failing?

Amir Frankel: Thanks, Nick. So even though corporate networks and modern cyberattacks grab proactive strategies, network security is stuck in a cycle of reactive defense. You need to contain the breach after it happened, and you need to use other tools. Right now, 83% of organization use EDRs, endpoint security, ways to, to detect. What happened us, to us — we collectively focus on detection and forgot prevention. And you know what? It is not working. We need to find another way. I will share some more bad news with you before — don't worry. Over time, we'll get to some good news. But one hundred ninety-four days — one hundred ninety-four days is the time it take to identify a breach in 2024. It's a very long time, from the time the attacker got into your network until you know about it. And you know what is even worse? One hour. One hour is the time it took in 20% of ransomware attack to start exfiltrating data. So even before — we talked about half a day. Half a day is also more than the one hour before they start to exfiltrate the data. And what is even worse? Fifty-one seconds. That's a new record measured by CrowdStrike this year for attackers to move — not only inside your organization, inside, not your organization, but in one organization. And if you look on the last few years, you can see nothing has changed in the last seven years. The times it takes to identify a breach is still pretty much the same, and the time it takes us to contain a breach is pretty much the same. And the number is pretty high: around, like I said, one hundred ninety-four days to identify it, and around seventy days to contain it.

Nicholas DiCola: I think we have, uh, a good audience.

Amir Frankel: As I —

Nicholas DiCola: Said, I think we have a good audience here, Amir, because most, uh, said they can do it in half a day, and we could see the average is up in the sixty-day range.

How much time do security teams spend firefighting?

Amir Frankel: Yeah. Yeah. I'm sure our audience are the best, uh, but we want also to help them reach it even down than half a day. Let's look a little bit on the burden that security teams have today. What happened, from what we get from the field? 83% of security teams say they are overwhelmed by alert volume, false positive, lack of context. 85% say they spend significant time on manual labor in order to deal with all this alert. 84% find themselves investigating the same incident several time and months. In some cases, you just finished investigating an incident, you look at your colleague, and find out you just investigated the same thing. It's a huge burden. So we want to talk a little bit, to ask you another question: how much of your time each week is spent firefighting? How much time each week are you dealing with all the alerts and all the things that come, just in order to make sure everything is okay, even without having any real attack inside your organization? So let's see. Let's hear your answer. So if you see, we have already 50%, almost, of the attendees answered. So let's continue to see. So, yeah, we see that people — that we can see something around 25 to 50% also the audience choose. But to say that the answer are bad, because you need this time to, to do things that are better, that you can spend on other stuff in your organization or in your own life. So, Nick, back to you.

How are attackers bypassing EDR?

Nicholas DiCola: I get to continue the bad news here, um, which is: sophisticated attacks are now commoditized. Um, we see in supply chain attacks, which are up 400% since 2021, it's really taking these tools that typically in the past nation-state actors only had access to. They're now commoditized, and, you know, quote-unquote, your script kiddies out there are able to now use these. And, and here's an example attack, uh, reported by The Hacker News, uh, around this, where it was a commoditized attack. And on top of that, because so many folks have kind of moved to, uh, EDR as kind of the main detection and response capability, attackers have started to move towards EDR killers. How do I bypass that? How do I get around it? How do I kill it, uh, and these types of things? Because this is what most companies are using to kind of protect, uh, that environment.

So if we take a real-world example of here, this was, uh, posted on BleepingComputer, uh, a while back. Uh, ransomware gang encrypted network from a webcam to bypass EDR. Right? So they basically got around the EDR. And if we dive in and look at how they did this, what happened was — like a typical attack path, you can see on the left, right — they gained initial access, and they used some privileged escalation, but then they laterally moved to a server in the network. They tried to do something, and the EDR actually quarantined the file. So the EDR did work in their favor and blocked that attack. So the attacker pivoted. They ended up finding a webcam that was unsecured. They laterally moved to that. And then from the webcam, they were able to go back to the original server they wanted to laterally move to, and bypass the EDR, because they were coming in in a different manner, and the EDR didn't detect it. So they're able to then encrypt that server, and, of course, they did this on many machines across the environment. But ultimately, it's the lateral movement that allows them to spread very fast across the environment, and makes your job really hard in containing them.

So when we think back to kind of the things that we talked about at the start — from this increase of securing sprawling, complex networks, to firefighting, chasing alerts, managing traditional security tools — and then we compound that with warding off relentless attacks that are now commoditized, uh, tools, what we end up with is an unwieldy burden of effort for security teams. So I think all of us at some point, uh, have felt like this person on the right side of the screen, you know, with a large bag of rocks on our back, and it keeps getting bigger and bigger, and we're trying to protect the environment, uh, and contain the attacker, and it just never ends. It keeps going and going and going. Now I'll turn it back to Amir to start sharing some good news. It's not all bad news, uh, but I'll turn it back to Amir.

Does microsegmentation work in the real world?

Amir Frankel: Thanks, Nick. So it's time to reset the cybersecurity power balance. It's time to transfer the burden of effort to the attackers, not to you, the security teams. So the good news: there is a solution. Microsegmentation can really work in reality. Here is an example of one of our customer, B. Riley Financial. Before they managed to have microsegmentation in place, they had challenges. They, they're really afraid about what will happen if MetaTech will get to their business, because it has very high effects. And on the other end, all their pentests keep on failing. They see red. I'm sure some of you see a lot of red report from pentests. Once they had microsegmentation, they managed to get green pentests. They eliminated the fear of lateral movement, because once you have microsegmentation, things really change. And like Aaron Goodwin, the CISO, told us: "We were able to stop those activities from occurring."

I assume all of you know MITRE. MITRE is the organization in charge of telling us how to stop attacks and research how they happened. In 2024, they got an attack. Threat actor managed to exploit their VPN. They used session hijacking in order to pass the MFA, and then they start to move laterally inside organization, using a compromised administrator account. So MITRE definitely used the best practices, the vendor instruction, whatever the government says, but they still didn't manage to detect the lateral movement. And like Charles Clancy, the CTO of MITRE, says, what you really need in order to stop lateral movement is robust multifactor, factor authentication and microsegmentation. So this is the MITRE ATT&CK framework. Let's talk about all the steps from infiltration until the organization is, let's say, toast. And you can see all the steps in the middle. All those steps are stopped by microsegmentation. Once you have microsegmentation in place, all those steps cannot happen. And who prepared this slide for us was one of our customer. While he was checking the solution, that was their conclusion. So, Nick, tell us how microsegmentation would have stopped this attack.

How would microsegmentation have stopped the webcam attack?

Nicholas DiCola: Yeah. So if we go back and look at the attack chain that we talked about before, remember that attacker started with initial compromise, and they were able to laterally move to a server, but they couldn't really get past the EDR. So now, when you have microsegmentation, and you're closing down all of those network ports, uh, that were potentially available to that attacker — well, now they can't laterally move, uh, to that server. And same thing with that OT asset. They're unable to laterally move to, protect, to that IoT webcam that was there, or OT asset that was there, and then unable to use that to laterally move to other assets. Because, again, you're closing down all the network ports that aren't needed and unused on the network, you remove those vulnerability paths. And ultimately, because you do that, the attacker is not able to be successful. So they can't land the ransomware on the server that they originally wanted to, or laterally move to other servers in the environment. And so you basically stop the attack. You've contained them on the first one. And I like to tell folks: what would happen if an attacker got into your environment and they can't laterally move? They can only stay on the first host they get to. They would leave, and they would go to another organization where they actually can laterally move. Because that is their ultimate goal: is to laterally move and spread throughout the network.

Why isn't everyone using microsegmentation?

Amir Frankel: So what we know from the field is, 96% of IT professional believe microsegmentation is a must. We also talked about the fact that MITRE think it's a must. But on the other end, only 5% are microsegmentation, microsegmenting today. So why is nobody doing this? From where does these, these demands come from? So legacy solution for microsegmentation are notorious for being complex, require a lot of manual labor. People believe that once they do it, it will have problem with scalability. They will lose their ability, uh, because we, as we saw in the beginning, network keep on changing, and it will cost a lot of money. And if someone will make a human error, it can have a big effect on the environment. But not only — sorry. But only — Gartner says that most network segmentation projects fail, and that most of them take long, longer than the average tenure of a CISO, and we all know how people like to start project they are not going to finish and see the result. So let's ask you guys: what do you think are the greatest challenges or concern with implementing microsegmentation? What worries you when you're thinking about starting this kind of project? So, again, we really like to hear what do you think. In this case, it's a multi-choice question. And so here, it will be hard to bet, because there are at least so many different answers.

Nicholas DiCola: It could be all of them equally.

Amir Frankel: See, people are starting to answer, as this is a multi-choice question. We'll give you a little bit more time this time.

Nicholas DiCola: I can definitely say that, uh, working with many customers, I've heard all of these in some way, shape, or form.

Amir Frankel: Uh, I guess in many cases, you heard all of them together.

Nicholas DiCola: Yeah. Brian commented, uh, "It's all of them." I love it, Brian. Thank you.

How does automation make microsegmentation possible?

Amir Frankel: So I think we'll wait, like, few more second, and then we'll continue to see the answers. See, already, we have more than 40% of the attendees answering it. I think we're good to see the result. So we see people believe it's very, very complex to implement, understand them, when you think about legacy solution. It might disrupt the environment. There are many good reasons here. But finally, it's time for some good news. Microsegmentation is finally made possible with automation. The Zero Networks platform will allow you to automatically tag asset and grouping. We are going to build the network rules and policies for you, both for asset and identity. And all of them will be tailor-made for each asset and for each group of asset in the network. Another very important thing we believe in: that you have to keep the privileged port close by default. And only whenever someone need to use them, automate just-in-time access using MFA in the network layer, which mean the network is closed, and only open when you need it, and only after you prove who you are. And we can give you a comprehensive solution that work both on-prem, in the cloud, for OT, for Kubernetes, altogether. And even more good news: it will tell you which fraction of the costs you're used to having, traditional segmentation. It has required you of both hardware and software, and a lot of money. When you think about legacy microsegmentation, the biggest issue is the cost and the manual labor. You need so many people to work on it. But in the Zero Networks way, it's fraction of the cost, because you are only software-based, and we're going to do most of the work — or, actually, all the work — for you. There is the defender's time.

Moderator: Nice job. Thank you, Amir and Nick. With that, we'll close out today's session. Thanks, everyone, for joining us, and hope to see you tomorrow for our final session. Thank you.

For the page

• Title tag: Stop Lateral Movement, Start Your Weekend | Zero Networks
• Meta description: Zero Networks' Amir Frankel and Nicholas DiCola show how attackers bypass EDR, and how automated microsegmentation stops lateral movement in real breaches.