ONE9’s featurette explores the ADAMnetworks core offerings and the Zero Trust Connectivity philosophy behind them, which lets defenders neutralize threats before they can execute or even be detected.
“When you learn this, you will never look at cybersecurity the same way again.”
— Glenn Cowan, ONE9
What the featurette covers
David Redekop, founder and CEO of ADAMnetworks, describes the key message: “We’ve essentially created a security layer to the IP protocol which simply didn’t exist in the original design of the internet. This is applicable for all devices that have the ability to potentially connect to the internet, and the technology was built to provide a default deny-all posture at scale that is incredibly practical and resilient.”
Francois Driessen, COO and CMO, explains why the philosophy matters as attackers adopt AI: “ONE9 gets what we do. If you follow the right philosophy you don’t have to be concerned about attackers getting more advanced by the use of AI in their detection evasion or for malware creation. Apply AI where it matters - don’t just create a more advanced whack-a-mole game where the attackers get to make the first move.”
adam:ONE® needs no endpoint agent on any protected device. IoT, OT and critical infrastructure can be protected by default, whatever the device type, software or operating system.
Steven Elliott, CFO and CRO, puts it this way: “Don’t play by the adversary’s rules. To win in cyber war, you simply remove your assets from the battlefield.”
Full Transcript
Glenn Cowan: When you learn this, you’ll never look at cybersecurity the same way again.
Steven Elliott: A massive cyber attack on Global Cyber Crime, Inc., effectively is the third-largest economy on planet Earth. It’s roughly a $10.5 trillion a year economy. The approach to fighting that adversary is to play by rules that are set by the adversary.
Francois Driessen: You can be as proactive in your security in preparing for that breach. But if you’re using reactive tools, you have a reactive posture. Bad guy still gets to make the first move.
Steven Elliott: Effectively, we’re living within the adversary’s game and we are playing by the adversary’s rules.
Francois Driessen: Better, higher, faster, stronger of doing the same thing that we used to do in the past is just not good enough. If it was, ransomware would not be an issue. Then cyber war would not be an issue. But it is today. And so we really need a new philosophy, and that’s why ADAMnetworks exists.
Francois Driessen: What do we do at ADAMnetworks? We basically neutralize advanced threats before they can execute and before it’s even possible to detect them.
Steven Elliott: When we talk about ADAM, we’re talking about the original Adam. That was the last man to live in a truly protected network.
Francois Driessen: We needed to protect our own families. And as we built on that, we realize the value of this in the security world.
Glenn Cowan: Every once in a while, we see a game-changing capability that we know we can’t live without.
Steven Elliott: We allow our clients to win the cyber war by simply removing their assets from the battlefield.
Francois Driessen: It resets what the internet is for me. The whole internet gets reset.
Francois Driessen: 10 years ago, the industry abandoned the idea of default-deny-all. It was just simply not practical. Okay? And for good reason. And so we went back to first principles and we got that to work.
David Redekop: So the industry dropped default-deny-all because it was much more important for business purposes to bring everything online. And so the desire to move forward in a digital conversion overrode any voices that spoke about the security risk. But in the process, what was created by the industry was a massive amount of porosity, an attack surface that was beyond anything we had possibly imagined. Everything from application weaknesses to open networks that just allowed any kind of traffic to flow. So the security industry responded like a whack-a-mole game by simply just addressing what was currently at the surface. So the fundamental problem with a whack-a-mole game is that you never get the first mover advantage.
Francois Driessen: So on the defense side, NIST Cybersecurity Framework, you’re going to govern through the process. You’re going to identify, protect, detect, respond, recover. You go through those phases. Right? Now what the industry has done is it’s actually moved all the virgin energy onto the detect phase. Now let’s look at the attack side. On this side, you got to get access. You got to evade detection. Then you got to escalate privileges, move laterally, infect, destroy, exfiltrate data, ransomware, whatever you want to do at that point, and then extort. Right now, what’s interesting is that all of these things that the bad guys do all happens before the detect phase. And that’s what we’re here to change.
Francois Driessen: At the core, ADAMnetworks’ adam:ONE®, it’s a DNS caching resolver that lives on top of a firewall engine. And it’s decentralized. The deployment is decentralized. There’s a centralized controller, but then it’s a decentralized brain, which means that the technology can scale not just to every device, but across theoretically every single network. And this brain operates on muscle memory to make decisions on the fly whether it allows or disallows connections. The beauty here is that that actually and the default state can run in a default-deny-all posture, which means that nothing is connected unless verified by the muscle, and the destination is verified by policy engine, but it’s only verified for the period of time to live and then gets collapsed again.
Francois Driessen: So we basically fixed the internet. We fixed the internet one connection at a time, not by changing what’s on the internet, not by throwing adversaries off the internet, but basically only allowing connections from the endpoint side to what is verified as to be good and required and necessary and vetted by the security administrator.
Francois Driessen: And so let’s say there’s some new threat that no one has seen before. No one’s detected it before and maybe it’s completely undetectable still today even. It just doesn’t matter. You don’t need to know about it first because it’s disallowed by default. And the beautiful thing is then, because it’s attempting to make its connections, you have full visibility and now it’s giving its connectivity request away. You’re not looking at what did already go wrong and you got to go clean up the mess. You are looking at what wanted to go wrong but it couldn’t.
Steven Elliott: So when I first became aware of ADAMnetworks, I was running a highly regulated financial services firm and we were getting what I consider to be pretty sophisticated inbound phishing attacks. And as I began to learn more and ask questions from security professionals about how those attacks would evolve and what we could do to mitigate them, effectively all of the legacy solutions, regardless of what the software was, boiled down to one thing: a reactive posture that could tell you what went wrong after the fact. And really the only protection that we were offered was training to help myself and my team not click on the link.
Francois Driessen: You cannot expect the human not to make a mistake, especially if they’re receiving an email crafted in the voice of their employer on a project that they currently working. With Zero Trust Connectivity, it doesn’t matter where you click. All of these connections are denied by default. You come up with some new domain or direct IP connection because you’re trying to circumvent the DNS firewalls that are out there and whatnot. Doesn’t matter. None of these connections are allowed unless verified device to a verified destination. And anything that’s unknown, we already know what it is. It’s not verified, so we just treat it as bad.
David Redekop: In traditional terms, we were always very well firewalled when it came to an ingress perspective. The attackers know this so that they don’t start with an ingress. They start from the inside and reach out.
Francois Driessen: If you can shut down egress, you pretty much shut down most known attack vectors that use the internet as part of that attack vector.
Glenn Cowan: You know, even if the adversary is able to get through sort of first defenses, we’re comfortable with them being resident in the network because we know that they can’t egress.
David Redekop: If there’s egress control or egress shutdown, the attacker can’t have any access. It’s as simple as that.
David Redekop: So we have about a billion internet registered domains in existence today, of which we’re observing about 600-some million are actively in use. And so the idea of trying to pick out threats in those domain names is a daunting task even for an advanced computer scientist. But what we noticed is that your typical enterprise only needs about 15,000 out of those 600 million.
Francois Driessen: There’s kind of these two philosophies: the idea of blocking what’s bad and allowing only what’s good. And in your mind, you think it’s the glass half full or the glass half empty, right? The reality is that it’s two very, very different worlds. World one, where you block the bad, to say, okay, I’m organizing a party, but I know these are five drinkers that are heavy and I’m not going to let them go there. So I’m getting sentry at the door, says, these guys have their names on this, these are bad guys, don’t let them in. Well, what about the guys that were bad for the first time? Now let’s look at another world where we say, no, no one gets to come to my party unless I put their names on the invitation list. Day of the party arrives, how many people’s at the my friend.
Steven Elliott: It’s not just the obvious of protecting against the bad. It’s about simultaneously enabling the organization who’s being protected. It’s about allowing that organization to operate with a degree of confidence and resiliency. It’s an empowerment tool just as much as it is a protective tool.
Steven Elliott: So part of the beauty of the solution is that it’s incredibly flexible in terms of how it’s deployed. It can augment existing security solutions or fully displace, depending on what the client wants.
Francois Driessen: If the technology that you already have is doing part of that job, ADAMnetworks technology can live on top of that in order to augment and cover the holes that there are.
Steven Elliott: In the cases where it augments, you can still pay the other vendor, the other sentry, to stand at the door. It’s just, with ADAMnetworks deployed concurrently, instead of standing in front of a door, that sentry is now standing in front of a wall.
Steven Elliott: We can play very well with others. And our goal is to meet the needs of the client and increase their security posture to something they never had previously.
David Redekop: The interesting fact is that when this is used in an incident response case, it shows exactly where traditional security failed.
Francois Driessen: Whatever anyone else would have done once you were breached, well, we just go ahead and do it right now.
David Redekop: Again, why not just be proactive and take a default denial approach in order to cover off all the gaps that traditional security cannot cover?
Francois Driessen: So, the net effect for security operation centers is huge here, because you have this incredible force multiplier, because you are spending your energy on dealing with threats that are already neutralized.
Glenn Cowan: And this is where I think one of the big challenges with the cybersecurity market is CISO fatigue. So the chief information security officer is just inundated with all these different tools that are essentially a better mousetrap.
Glenn Cowan: If you are trying to best protect your network, you’re constantly being bombarded with all these different aspects of how I’m going to protect and where I’m going to sit on the network and what I’m going to do, and they all have to integrate together and form this sort of tech stack, and then they have to be updated and changed and modernized, and it’s exhausting. And what we love about ADAM is they’re not selling a widget. They’re selling a whole new way of thinking through protecting your enterprise.
Francois Driessen: The question is, will this actually slow me down? It’s a very important question and one that I love to answer. It’s going to sound like I’m BSing, because it will actually speed up your connection. It depends on which mode you’re running. If you run in adaptive allow listing and it’s already gone through learning mode and it’s written to your dynamic allow list, that connection will actually be faster because it’s a DNS caching resolver. And if you need to run in reflex mode, which means that it needs to make the decision on the fly, we can make 20 decisions per device in the single blink of a human eye. Default-deny-all, invisible to the user.
Francois Driessen: Will I entrust my data in someone else’s hands? Well, the answer is simple. You should never do that. You know, to us, sovereign data custody is really, really important. The technology was designed the way that we would want our own data to be treated. So we just never felt comfortable with the idea that our data has some sort of, like, centralized flow, gets shipped to someone else’s cloud, which is convenient for them. I understand that it’s the most convenient way to build that technology, but then have our data decrypted in plain text, with all of our TLS keys, our API keys, master password, sitting in a centralized place, creating a hyper-valuable target, because you’re combining it, not just our data, but everyone else’s data that’s coming to that same place. To us, that just didn’t make sense. Sovereign data custody was at the core of the ADAMnetworks design.
Francois Driessen: The people who are using ADAM, short version, is really just someone that can’t afford to have a breach.
David Redekop: Everywhere from finance and banking to commercial operations to service industries, first responders, medical, education and schools protecting students and endpoint devices, and also manufacturing, where operational technology is critical, where downtime is measured in seconds.
Glenn Cowan: You know, ADAMnetworks, through its hardware-software combination and its sort of underlying first-principle ethos of sort of widespread macro protection, we don’t have to worry about keeping an adversary out of our network, and we can do that across the enterprise, across the network, right down to the device level.
Steven Elliott: There’s a financial mandate for any company to grow and be profitable. But for us, growth and profitability is an outcome of a much bigger calling and a much bigger mission, which is truly to protect people and the devices and networks they care about. Because if we don’t do that, it’s not just a matter that our bottom line is not as healthy as we would like it to be, but potentially our infrastructure and way of life may cease to exist.
Francois Driessen: I think the idea of cyber war cannot be ignored anymore.
Steven Elliott: Now that we’ve spent the last 25 years connecting virtually every aspect of our lives to the internet, to in some cases include our light bulbs, we have also unwittingly entered a global cyber battlefield. We are in a persistent state of conflict.
Francois Driessen: Don’t just think that just the military is a target. What they’re going to go for is everyone’s home, infrastructure, hospitals.
Steven Elliott: When we think about the adversary, we’re obviously thinking about those individuals that want to steal data and steal financial resource. But we also have to recognize that we’re dealing with nation-state actors as well, where it’s not just bullets and bombs, it’s zeros and ones.
Glenn Cowan: The second a sophisticated adversary wants to penetrate and gain access, they’re going to do it.
Francois Driessen: It’s actually by grace that we haven’t seen more large-scale attacks do more damage. But essentially what’s happening is that behind the scenes there’s espionage happening to make the impact of these attacks, when they will hit, so much bigger.
David Redekop: So today an attacker really only needs two elements. First, domain credentials, which can either be obtained by stealing them or copying them from the dark web or getting an initial access broker to offer them. And secondly, a remote hook.
Francois Driessen: The time is now to shut it down. The time is now to be able to have tools in the defender’s pocket.
David Redekop: So, the simple answer in order to actually prevent that connection from happening to begin with is to do default-deny-all. We disconnect. We only need to connect to verified known destinations, and for short periods of time. That’s the solution.
