Notifications
Clear all
Topic starter
10/07/2026 9:28 pm
TL;DR: Law firms are pairing microsegmentation, identity segmentation, and RPC firewalling to contain ransomware and lateral movement as detection-heavy models fail, according to Zero Networks and session speakers. The governance lesson is clear: if one compromised system can reach most of the environment, privilege boundaries are too open to defend.
NHIMG editorial — based on content published by Zero Networks: How Law Firms Strengthen Network Security
By the numbers:
- Only 30% of alerts generated translate to real risk reduction, while a single compromised system typically gives attackers access to 85% of the environment in one hop.
- Ransomware is up about 100% since 2024, and breaches reported globally have climbed 660% since 2021.
Questions worth separating out
Q: How should security teams reduce lateral movement after an initial compromise in a flat network?
A: Security teams should reduce reachable paths first, then tune detection around the smaller attack surface.
Q: Why do service accounts increase breach blast radius when they are not tightly scoped?
A: Service accounts increase blast radius because they often have persistent access across multiple systems and are exempt from the normal human login patterns that teams monitor most closely.
Q: What breaks when identity segmentation is not enforced for privileged users?
A: What breaks is the assumption that privileged identities are constrained by role or workstation.
Practitioner guidance
- Map identity reach before you segment networks Inventory where human users, service accounts, and privileged accounts can log in today, then identify systems that should never accept those identities.
- Constrain service-account login scope to workload reality Review every service account for cross-host and cross-segment reach, then remove login rights that are not required for the specific workload.
- Block dangerous RPC functions while preserving necessary traffic Leave RPC available only where required, but filter the specific operations that enable directory replication and domain controller abuse.
What's in the full article
Zero Networks' full article covers the operational detail this post intentionally leaves for the source:
- How Cravath approached host-based firewall modernisation across workstations and non-critical servers.
- The practical role of automated policy learning in reducing manual rule creation and tuning.
- Why service-account segmentation and RPC firewall functions expanded the project beyond standard network segmentation.
- The specific implementation considerations behind identity-driven microsegmentation in a legal-sector environment.
👉 Read Zero Networks' analysis of law firm network security, microsegmentation, and automation →
Microsegmentation for law firms: what identity teams need to know?
Explore further
10/07/2026 9:50 pm
Identity segmentation is now a governance control, not a network add-on. When accounts can log in almost everywhere, the real failure is not the firewall policy but the identity model that permits that reach. Law firms cannot treat service accounts and privileged users as isolated technical exceptions because their movement rights define breach blast radius. The practical conclusion is that identity scope has become part of containment architecture.
A few things that frame the scale:
- Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, according to The State of Non-Human Identity Security.
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, with 38% reporting no or low visibility and 47% reporting only partial visibility.
A question worth separating out:
Q: Who is accountable when a checked-out privileged credential is used outside its intended scope?
A: Accountability sits with the identity governance process, not just the individual user. If a credential checked out from PAM can still be used broadly on the network, the control boundary is incomplete. Security, IAM, and infrastructure teams must share responsibility for enforcing where that credential can operate.
👉 Read our full editorial: Law firm network security now depends on identity-driven containment
