Cyber Security Controls Demystified Part 13 - Distributed Firewall

In this episode, we break down what a Distributed Firewall is, how it extends security beyond the traditional network perimeter by enforcing firewall policies directly on individual workloads, virtual machines, containers, cloud instances and endpoints, and why it has become a critical component of modern cyber security architectures that rely on microsegmentation, Zero Trust principles and cloud-native infrastructure to protect highly distributed environments from advanced cyber threats. 

Duration: 0:00:22

Visit https://www.wecyberyou.com for more cyber security education, resources and awareness content like this. 

Thank you for listening. 
WeCyberYou! Team

Transcript

SPEAKER_00 0:00

You know, usually when we think about security, whether it's, I don't know, a physical bank or a corporate computer network, we always picture this massive, heavy front door.

SPEAKER_01 0:10

Oh yeah. The classic fortress approach.

SPEAKER_00 0:12

Aaron Powell Right. You put all your best locks, uh, your cameras, your guards right there at the main entrance. And it's comforting, I think, because it's a very clear boundary. You are either inside the fortress or you are completely outside.

SPEAKER_01 0:25

Trevor Burrus, Jr.: Which was great, you know, 20 years ago.

SPEAKER_00 0:28

Exactly. But then you look at the reality of modern IT and you realize the walls are completely gone. That massive heavy door is just sort of standing all by itself in the middle of an empty field.

SPEAKER_01 0:39

Aaron Powell It really is. I mean, it is the absolute definition of an obsolete defense strategy. We are basically trying to protect a modern, invisible, and highly scattered city with a medieval moat.

SPEAKER_00 0:50

Right, a moat.

SPEAKER_01 0:51

Yeah. And the threat actors, they know exactly how to just walk right around that moat.

SPEAKER_00 0:54

Which means your data is exposed in ways that old tools simply cannot see. So welcome to the With Cyber U Unlocked podcast, where we are going to fix that.

SPEAKER_01 1:03

Glad to be here for it.

SPEAKER_00 1:04

If you are joining us today, please take a quick second to follow the channel and definitely visit WeCyberU.com for more content like that. Today we are taking a deep dive into architecting modern workload security through distributed firewalls.

SPEAKER_01 1:18

It's a huge topic.

SPEAKER_00 1:19

It really is. Yes. And here's why you need this knowledge right now. If your company uses the cloud, or if you have literally any remote workers, or if your team builds modern applications, the old way of protecting your data is officially broken.

SPEAKER_01 1:34

Completely broken.

SPEAKER_00 1:34

Aaron Powell So this deep dive is your shortcut to understanding the cutting edge of workload security without drowning in IT jargon. So let's just unpack this right out of the gate. Why is that old moat and castle model failing so spectacularly today?

SPEAKER_01 1:49

Aaron Powell Well, to understand the solution, you really have to understand the environment. So for decades, enterprise security relied entirely on perimeter firewalls.

SPEAKER_00 1:57

The big front door.

SPEAKER_01 1:58

Right. Think of physical, actual hardware appliances bolted into metal racks at the very edge of the corporate network. The assumption back then was that the vast majority of traffic just flowed in and out of a very clearly defined network boundary.

SPEAKER_00 2:12

Aaron Powell Because everyone was in the same building, right?

SPEAKER_01 2:13

Trevor Burrus Exactly. All the employees were physically sitting inside a corporate office building. The servers were locked in an on-premises data center just down the hall.

SPEAKER_00 2:21

Aaron Powell So you had a very predictable flow of traffic.

SPEAKER_01 2:24

Yeah.

SPEAKER_00 2:24

But today, I mean, organizations operate in these massive multi-cloud environments.

SPEAKER_01 2:29

Aaron Powell Oh, yeah. AWS, Azure, all of it. Aaron Powell Right.

SPEAKER_00 2:32

They use hybrid cloud infrastructures. You have a massive remote workforce logging in from local coffee shops and home Wi-Fi networks.

SPEAKER_01 2:39

Trevor Burrus, which are notoriously unsecure.

SPEAKER_00 2:41

Trevor Burrus Totally. And we rely heavily on software as a service applications, virtual machines, and containers, which for anyone who might not know, are essentially these lightweight portable environments for running software.

SPEAKER_01 2:55

And all of that, that whole shift completely shatters the old architecture. I mean, the perimeter firewall was designed for a centralized world, but modern IT is completely decentralized.

SPEAKER_00 3:07

Okay. So to use an analogy here, the traditional firewall is basically a nightclub bouncer at the front door.

SPEAKER_01 3:13

I like that. Yeah.

SPEAKER_00 3:14

He checks IDs, makes sure you are on the list, and if you are, you get into the club. But if a bad actor sneaks through a side window, let's say they compromise a remote worker's laptop that is connected via a VPN, they're now inside the club.

SPEAKER_01 3:28

And the bouncer has no idea.

SPEAKER_00 3:30

Right. The bouncer at the front door has no idea. So does the attacker just have free reign inside the club at that point? I mean, is that fundamental flaw what is driving this entire shift?

SPEAKER_01 3:39

That is the exact flaw driving the evolution of modern security today. Because once an attacker bypasses that front door, the perimeter firewall has almost zero visibility into what happens inside the network.

SPEAKER_00 3:51

Wow. Zero visibility.

SPEAKER_01 3:53

Pretty much. In cybersecurity, we called this lateral movement. So let's walk through how this actually looks in the real world. An attacker gains an initial foothold, right? Maybe through a cleverly disguised phishing email that a receptionist clicks on.

SPEAKER_00 4:07

Happens all the time.

SPEAKER_01 4:08

All the time. And the perimeter firewall actually allowed that email through because it looked legitimate.

SPEAKER_00 4:14

Okay, so now the attacker is on the receptionist laptop.

SPEAKER_01 4:17

Yes. And because the internal network is largely unguarded, they don't just stay on that laptop, they start probing the internal network.

SPEAKER_00 4:25

Looking for the good stuff.

SPEAKER_01 4:26

Exactly. They find a path to a finance server. From the finance server, they extract some credentials that get them into a really sensitive customer database. And the crazy part, the entire time this lateral movement is happening, the perimeter firewall at the edge of the network never even sees it.

SPEAKER_00 4:44

Because it's only watching the front door.

SPEAKER_01 4:45

Right. It is completely blind to that internal hopscotching.

SPEAKER_00 4:49

Wow. So because the castle perimeter is gone, the actual way data moves has fundamentally changed. We're essentially shifting the primary battleground from the border to the interior.

SPEAKER_01 5:00

Yes, absolutely.

SPEAKER_00 5:01

And to really grasp this, our sources point out that we need to talk about the compass of cyber threats, which is north-south versus east-west traffic.

SPEAKER_01 5:10

Oh, this is a critical concept for anyone dealing with modern networks. So when we say north-south traffic, we are talking about data entering or leaving the organization.

SPEAKER_00 5:19

Like top to bottom on an architectural diagram.

SPEAKER_01 5:22

Exactly. From the wild, untrusted internet down into your corporate network, or vice versa. This is exactly what those old perimeter firewalls were designed to protect.

SPEAKER_00 5:32

Aaron Powell The bouncer checking people coming in from the street.

SPEAKER_01 5:34

Aaron Powell Yes. But today, because of all those modern technologies we just mentioned, like microservices, where an application is broken down into dozens of smaller components that all constantly talk to each other, the vast majority of traffic is actually East-West.

SPEAKER_00 5:48

Okay. So East-West is the communication between internal workloads.

SPEAKER_01 5:52

Yes, internal.

SPEAKER_00 5:52

Like an application server talking to a database server. Or one container talking to another container inside a server cluster. You got it. It's moving horizontally across the internal network and it never actually goes out to the internet.

SPEAKER_01 6:04

Right. And modern attacks, they almost always spread laterally using that east-west traffic. The initial breach, like getting onto the receptionist's laptop, is really just step one.

SPEAKER_00 6:16

Just getting in the building.

SPEAKER_01 6:17

Yeah. The real damage, the data exfiltration or the ransomware deployment that happens when they move east-west to find the valuable data.

SPEAKER_00 6:25

Okay, wait, I have to ask on behalf of anyone listening who actually manages internal networks. Aren't those internal systems naturally safer?

SPEAKER_01 6:33

Oh, you would think so, right?

SPEAKER_00 6:34

Yeah. I mean, they are authenticated systems owned by the company. So why are we suddenly treating our own internal servers and databases like untrusted strangers on the street?

SPEAKER_01 6:45

Aaron Powell It's a fair question. And it used to be the dominant mindset that if you were inside the building, you were trusted. But the decentralized nature of modern IT has completely dismantled that assumption.

SPEAKER_00 6:56

How so?

SPEAKER_01 6:56

Because your environment is so scattered now, it's spread across thousands of home networks, public clouds, mobile devices. An initial compromise is mathematically inevitable.

SPEAKER_00 7:07

Somebody's gonna click a bad link.

SPEAKER_01 7:08

Always. Someone will click it. So if you assume internal traffic is inherently safe, you are essentially leaving the bank vault wide open just because someone managed to get into the lobby.

SPEAKER_00 7:20

Oh wow. That's a scary thought.

SPEAKER_01 7:23

Aaron Powell It is. You can no longer assume any internal communication is safe just because it originated from an internal IP address. Aaron Powell Okay.

SPEAKER_00 7:30

So if we can no longer trust internal traffic, we obviously need a way to inspect it. But we can't route every single internal conversation back to the front door bouncer.

SPEAKER_01 7:39

No, that would be a disaster.

SPEAKER_00 7:41

Aaron Powell Right. If my application server needs to ask my database for a piece of information, sending that request all the way to the edge of the network and back would just bring the whole system to a grinding halt.

SPEAKER_01 7:51

The latency would be completely unmanageable.

SPEAKER_00 7:53

So how do we solve this? And I guess this brings us to the actual architecture of the distributed firewall.

SPEAKER_01 7:59

Yes. And this is where the engineering gets truly elegant. So a distributed firewall is a security architecture where the firewall functionality is completely decentralized.

SPEAKER_00 8:10

Okay, decentralized.

SPEAKER_01 8:11

Instead of being concentrated in a single massive hardware appliance, the firewall is distributed across the entire infrastructure, is placed directly at or very near each individual workload.

SPEAKER_00 8:22

Aaron Powell So going back to the nightclub analogy, instead of one bouncer at the front door, it's like every single person inside the club has their own personal invisible bodyguard.

SPEAKER_01 8:32

Aaron Powell I love that. Yes.

SPEAKER_00 8:33

And that bodyguard is checking IDs before a conversation can even start.

SPEAKER_01 8:37

Aaron Powell That is exactly how it functions. Every protected system effectively has its own firewall. And it does this using lightweight software agents or controls built directly into the hypervisor.

SPEAKER_00 8:48

And the hypervisor is the software layer that manages all your virtual machines, right?

SPEAKER_01 8:52

Aaron Powell Exactly. But the real genius of this architecture, what makes it actually work, is the separation of powers. You have centralized management on one side and distributed enforcement on the other.

SPEAKER_00 9:01

Aaron Powell Let's unpack that separation because our sources highlight it as a defining characteristic of this technology. So centralized management means the administrators still define all the rules in one single place.

SPEAKER_01 9:14

Right. You aren't running around configuring everything manually. Trevor Burrus, Jr.

SPEAKER_00 9:17

Yeah, you don't have to log into 10,000 different servers to update a single rule. You sit at a central console and declare, you know, finance servers can only talk to payroll databases. Trevor Burrus, Jr.

SPEAKER_01 9:27

That central console is basically the brain of the operation, but the muscle, the actual enforcement of that rule happens locally.

SPEAKER_00 9:35

Ah, so brain versus muscle.

SPEAKER_01 9:36

Aaron Powell Right. Instead of the finance server sending its traffic all the way across the network to a central appliance to ask for permission, the server's own local bodyguard enforces that rule right there on the spot.

SPEAKER_00 9:49

Which completely eliminates those network bottlenecks.

SPEAKER_01 9:51

Exactly.

SPEAKER_00 9:52

It prevents unnecessary network hops.

SPEAKER_01 9:54

Yeah.

SPEAKER_00 9:55

And you get consistent security controls across the entire environment without degrading performance. Trevor Burrus, Jr.

SPEAKER_01 10:00

That's the beauty of it.

SPEAKER_00 10:02

The research actually maps out how this operationalizes in real time. Yeah. And it really demystifies the whole process. It starts with uh workload identification.

SPEAKER_01 10:11

Yes. Step one.

SPEAKER_00 10:12

And the crucial detail here is that the firewall uses logical identities, not just IP addresses. How does that practically change things?

SPEAKER_01 10:23

Well, think about what an IP address is. It's essentially just a temporary parking spot on a network. It's a number that can change, and more importantly, it can be spoofed by an attacker pretty easily. Right. But a logical identity is intrinsic to the workload itself. The distributed firewall identifies what it is protecting based on deeply embedded attributes.

SPEAKER_00 10:42

Aaron Powell Like what kind of attributes?

SPEAKER_01 10:44

Like is this a virtual machine? Is it a specific application container? What is the user's role? It understands the absolute context of the workload.

SPEAKER_00 10:52

So it knows this is the HR database, not just this is IP address 192.168.whatever.

SPEAKER_01 10:57

Exactly.

SPEAKER_00 10:57

That makes a massive difference because in cloud environments, IP addresses are constantly shifting around.

SPEAKER_01 11:02

Aaron Powell They change all the time.

SPEAKER_00 11:03

Aaron Powell So once it knows who everyone is, it moves to central policy creation. This is where the security admins create the actual rules. And because of those logical identities, you can make rules based on real business functions.

SPEAKER_01 11:17

Yeah, you can write policies that actually make sense to humans.

SPEAKER_00 11:20

Aaron Powell Like development environments cannot access production databases.

SPEAKER_01 11:23

Trevor Burrus Yes. And once those rules are created, the centralized controller distributes them. But here is the really critical part. Each workload only receives the rules relevant to its specific role.

SPEAKER_00 11:36

Aaron Powell Oh, interesting.

SPEAKER_01 11:37

Yeah. The HR database doesn't need to know the firewall rules for the marketing web server. It only gets the rules that tell it who is allowed to talk to HR.

SPEAKER_00 11:46

Wow, that is incredibly efficient. It's not bogging down the server with a million irrelevant rules.

SPEAKER_01 11:50

Exactly.

SPEAKER_00 11:51

Then we hit local traffic inspection. This is where that personal bodyguard really steps in. When a request comes in, the firewall inspects the traffic directly on the workload, right?

SPEAKER_01 12:00

Right on the workload.

SPEAKER_00 12:01

It evaluates the source, the destination, the port, the user context, and it does all this before the traffic even reaches the operating system.

SPEAKER_01 12:09

That's the key. It stops the threat before it even touches the vulnerable surface of the machine, which then triggers the final action, which is enforcement.

SPEAKER_00 12:17

Okay, enforcement.

SPEAKER_01 12:18

Based on those precise rules, the local firewall will allow the traffic, block it, log it, or even trigger an automated alert. And because this enforcement happens locally, malicious traffic is stopped dead in its tracks before it can spread to other systems.

SPEAKER_00 12:34

It really is a complete paradigm shift. Yeah. And with every workload having its own local bodyguard, organizations can implement a totally new level of security called micro-segmentation.

SPEAKER_01 12:44

A very popular word right now.

SPEAKER_00 12:45

It is a massive buzzword. Yeah. But we need to make it tangible for the listeners.

SPEAKER_01 12:48

Aaron Powell Well, microsegmentation is arguably the most powerful capability enabled by distributed firewalls. Historically, if you were on a specific network subnet, you were trusted by everything else on that subnet.

SPEAKER_00 13:01

Like a big flat open room.

SPEAKER_01 13:02

Right, a flat network. Microsegmentation divides the network into tiny isolated segments down to the individual machine. It means a workload can only communicate with explicitly authorized systems.

SPEAKER_00 13:14

So instead of trusting a whole floor of the building, you only trust specific people to open specific doors on that floor.

SPEAKER_01 13:21

Exactly.

SPEAKER_00 13:21

And this ties directly into the philosophy of zero trust, doesn't it?

SPEAKER_01 13:24

It does. Zero trust is exactly what it sounds like. It's a security framework that assumes no traffic is trustworthy by default, whether it's coming from outside or inside the network.

SPEAKER_00 13:34

Trust nothing, verify everything.

SPEAKER_01 13:36

Exactly. It requires that every single communication request be continuously verified. And distributed firewalls are the key technology that actually makes zero trust possible because they enforce least privilege access right at the workload level.

SPEAKER_00 13:51

And because it's software-based and tied to the workload itself, it is incredibly cloud native.

SPEAKER_01 13:57

Oh, absolutely.

SPEAKER_00 13:58

The documentation points out that this works perfectly across entirely different environments like Amazon Web Services, Microsoft Azure, Google Cloud Platform, because the security literally follows the workload.

SPEAKER_01 14:09

Yes, it travels with it.

SPEAKER_00 14:11

If you spin up a virtual machine in AWS and then six months later you move it to Azure, its personal bodyguard goes with it. The policy stays impact.

SPEAKER_01 14:20

And that portability is essential for modern IT agility. I mean, you don't have to reconfigure a massive hardware appliance every time your development team moves an application or changes cloud providers.

SPEAKER_00 14:32

Because the logical identity remains the same.

SPEAKER_01 14:34

Right. So the rules remain the same.

SPEAKER_00 14:36

Okay, wait. If zero trust literally means trust nothing, and we are putting up microscopic walls between every single tiny component using microsegmentation, how does any actual work get done? I hear this all the time. I mean, doesn't this create massive friction and delays for legitimate applications that are just trying to communicate and do their jobs? If the marketing app needs to talk to the email server, do they have to wait for an administrator to approve it manually?

SPEAKER_01 15:05

That is the most common fear executives have when they hear zero trust, but it actually doesn't stop work at all. It just establishes explicitly authorized paths. Remember the central brain we talked about. Because the policies are managed centrally but enforced locally by the workload itself, the system automatically adapts.

SPEAKER_00 15:21

Oh, so it's automatic.

SPEAKER_01 15:23

Yes. When a new authorized workload is spun up, the orchestration tools instantly talk to the central firewall manager and apply the correct policies in milliseconds.

SPEAKER_00 15:34

Milliseconds. Wow. Trevor Burrus, Jr.

SPEAKER_01 15:35

It scales dynamically without any human intervention. So there is zero friction for legitimate pre-authorized traffic, but an absolute brick wall for unauthorized traffic.

SPEAKER_00 15:47

So it's not about making communication harder, it's about making unauthorized communication impossible.

SPEAKER_01 15:53

That's a great way to put it.

SPEAKER_00 15:54

But you know, this level of frictionless control sounds a little bit like a cybersecurity utopia. And in my experience, utopias usually have a catch.

SPEAKER_01 16:01

Aaron Powell They always have a catch.

SPEAKER_00 16:03

Right. So let's do a reality check here based on our sources. What are the actual hurdles and limitations of deploying a distributed firewall in the real world? Because this can't be as simple as just flipping a switch.

SPEAKER_01 16:13

It is definitely not a magic wand. And there are several major challenges. First and foremost is the increased complexity during the initial setup.

SPEAKER_00 16:20

Figuring out the rules in the first place.

SPEAKER_01 16:22

Exactly. If you have a massive legacy enterprise environment that's been built over 20 years, mapping out all those business functions and explicitly authorizing every single communication path, well, it requires meticulous planning.

SPEAKER_00 16:37

Yeah, I bet. If you do it wrong, you will block legitimate traffic and break your own applications.

SPEAKER_01 16:43

You'll bring your own company down.

SPEAKER_00 16:45

You really have to know exactly how your applications are supposed to interact before you can write the rules for them. And let's be honest, a lot of organizations have legacy apps running in the basement that nobody fully understands anymore.

SPEAKER_01 16:57

Oh, absolutely. The classic don't touch that server problem.

SPEAKER_00 17:00

Right. And the research also highlights agent management as a hurdle. Because this relies on software agents running on the workloads, those agents require maintenance, updates, and troubleshooting, just like any other piece of software.

SPEAKER_01 17:13

They do. And you also have major integration requirements. A distributed firewall doesn't operate in a vacuum. It has to tie into your identity providers, your cloud services, your virtualization platforms, and your orchestration tools.

SPEAKER_00 17:26

They all have to speak the same language.

SPEAKER_01 17:28

Yes, or it just won't work.

SPEAKER_00 17:30

Which brings up a really crucial caveat from the deep dive materials. A distributed firewall is not a complete security solution on its own.

SPEAKER_01 17:37

Not at all.

SPEAKER_00 17:38

The architecture explicitly requires it to complement, not replace your existing tools. So you still need your perimeter farewalls, your web application firewalls, or WFs to protect public facing sites. You still need your endpoint detection and response, or EDR, for employee laptops.

SPEAKER_01 17:56

Don't forget identity management.

SPEAKER_00 17:57

Right, identity and access management, or IAM, to handle passwords and logins. And you still need your SIME.

SPEAKER_01 18:04

And your extended detection and response or XDR, which correlates data across all those tools.

SPEAKER_00 18:09

Okay, hold on. Let me play devil's advocate.

SPEAKER_01 18:11

Yeah.

SPEAKER_00 18:11

If I am an IT director and I still have to buy and maintain my perimeter firewall, my EDR on the laptops, my identity management, and my SIM to collect all the logs, aren't distributed firewalls just adding another incredibly expensive, complex layer of maintenance to an already massive stack of tools?

SPEAKER_01 18:28

It sounds like it, doesn't it?

SPEAKER_00 18:30

Yeah. Aren't we just talking about severe tool fatigue here?

SPEAKER_01 18:32

Well, tool fatigue is a massive issue in the industry right now. I won't deny that. But if we look at how these systems actually interact, the distributed firewall isn't just another layer of the same thing. It actually completes the puzzle. Oh so think about the blind spot we discussed earlier. Your perimeter firewall is completely blind to east-west traffic, right?

SPEAKER_00 18:53

Right. The internal lateral movement.

SPEAKER_01 18:55

Exactly. Now think about your SIME, which is essentially a giant aggregator for security logs. It can only analyze the data it receives. If the perimeter firewall never sees the internal lateral movement, it never sends a log to the SIM.

SPEAKER_00 19:10

Oh, I see.

SPEAKER_01 19:11

Which means the SIME's analysis is fundamentally flawed because it is missing half the picture.

SPEAKER_00 19:15

Uh-huh. So the distributed firewall is illuminating that massive blind spot.

SPEAKER_01 19:19

Yes. By providing detailed granular visibility into those internal communications, the distributed firewall actually makes your other tools much more effective.

SPEAKER_00 19:28

It gives them better data.

SPEAKER_01 19:30

Exactly. It feeds incredibly rich, context-aware data into your CM and your XDR, allowing them to detect behavioral anomalies that they would have completely missed otherwise. It doesn't duplicate your efforts, it acts as a force multiplier for the investments you've already made.

SPEAKER_00 19:45

Wow. Okay, so what does this all mean? If we step back and look at everything we've unpacked today, how do we summarize this massive shift in how we protect data?

SPEAKER_01 19:54

I'd say the fundamental takeaway was that we are witnessing a permanent shift from perimeter-based security to workload-centric protection.

SPEAKER_00 20:02

Rebouncer to the bodyguard.

SPEAKER_01 20:04

Yes. The idea of a single choke point at the edge of the network is dead. Security must now be distributed across individual servers, containers, and cloud workloads. It has to follow the asset, regardless of where that asset resides.

SPEAKER_00 20:17

And as we look toward the future, based on our sources, the technology is only going to get more advanced. We are looking at AI-driven automated policy generation, where the firewall actually learns your environment by watching the traffic flows and then suggests the microsegmentation rules for you.

SPEAKER_01 20:32

Which takes the human guesswork completely out of it.

SPEAKER_00 20:35

Totally. And we'll see tighter integration with zero trust network access and secure access service edge or SASE platforms, creating a unified mesh of security.

SPEAKER_01 20:45

The environment is only going to become more dynamic, which means the security has to become more intelligent and autonomous. Relying on manual updates to a central hardware box is simply no longer viable.

SPEAKER_00 20:56

Which is incredibly exciting, but also, you know, incredibly daunting.

SPEAKER_01 21:00

It's a lot to take in.

SPEAKER_00 21:01

It really is. Thank you so much for breaking that down, and thank you to everyone for joining us for this deep dive on the We CyberUnlocked podcast. We really appreciate you spending your time with us. Please don't forget to follow the channel and visit WeCyberU.com for more content like that.

SPEAKER_01 21:15

It's been a really great discussion.

SPEAKER_00 21:17

But before you go, we want to leave you with one final thought to mull over, building on what we've explored today. We talked about how dynamic modern IT is. But as organizations move toward highly ephemeral cloud environments where a container might spin up, execute a function, and then completely delete itself in a matter of milliseconds. So how will distributed firewalls adapt to secure a workload that disappears before a human can even register it existed? That's the million dollar question. If the nightclub bouncer is gone and the invisible bodyguard only exists for a microsecond, how do you secure the ghost in the machine? Something to think about. Until next time, stay curious.