Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

4/5/2019
10:30 AM
Stephen Cox
Stephen Cox
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
100%
0%

The Matrix at 20: A Metaphor for Today's Cybersecurity Challenges

The Matrix ushered in a new generation of sci-fi movies and futuristic plotlines with a relentless, seemingly invulnerable set of villains. Twenty years later, that theme is all too familiar to security pros.

It's difficult to believe that The Matrix celebrated its 20th anniversary in March. It's equally hard to ignore how well the film has stood the test of time. With Oscar-winning innovations in stunt work and special effects such as "bullet time," the sci-fi epic starring Keanu Reeves and Laurence Fishburne changed Hollywood, according to some film critics.

At least, I think so.

It's not just the special effects and plot development that remain fresh. What's relevant for security professionals is the similarities between the characters and plot and how we look at modern security practices and technology.

The film's protagonist — the computer programmer Mr. Anderson, played by Reeves — is one of billions of humans unwittingly inhabiting a simulated reality, referred to as the "Matrix." Through a process of self-realization and literal rebirth, he becomes the hero, Neo. The process has been triggered by his choice of swallowing a "red pill" of reality instead of the "blue pill" that will keep him ignorantly complacent in a contrived, alternative, and manipulative world.

Neo is analogous to present-day CISOs: security professionals who have taken the "red pill" and are awake to the reality of protecting a real-life business amid the frightening, shape-shifting threats from cybercriminals seeking to do harm. In The Matrix, this ever-present evil is determined to destroy Zion, the last human-inhabited city in the world.

How Neo Battled the 'Advanced Persistent Threat'
Shape-shifting is core to the movie's plot. "Agents," Neo's sinister enemies, take over the bodies of innocent bystanders in their relentless pursuit of Neo and his crew. The cybersecurity analogy here is an advanced persistent threat (APT) group utilizing stolen credentials to gain a foothold into an organization — one of the most pernicious elements facing today's enterprise.

Modern breaches often involve malicious APT-like agents gaining access to an employee's credentials in order to achieve their goal. This usually happens as a result of spearphishing attempts, enabling attackers to steal customer data, intellectual property, or financial and banking data.

Just as Neo stays vigilant in looking for constant threats, CISOs fight the epidemic of stolen credentials with proactive risk-based authentication techniques that stop attackers from even obtaining a foothold in the first place. The key in both situations is having visibility into attacker behavior.

The Battle Against Insider Threats, Matrix-style
As Neo begins his journey to the "real world," a jaded crew member, Cypher (Joe Pantoliano), asks, "Why, oh why, didn't I take the blue pill?" This was Cypher's rhetorical regret for not choosing to accept an easy, stress-free life in the Matrix rather than remaining in his real-world existence. Cypher's words actually foreshadow his true intentions when it's revealed he has sold out the crew on their ship, the Nebuchadnezzar, to the Agents in order to be "reborn" as a rich celebrity in the Matrix — without any memory of his past life.

Cypher represents an insider threat, trading the whereabouts of his crew for his own gain. In cybersecurity terms, insider threats are often embodied by employees, temporary workers, or contractors who have access to an organization's systems. Insider threats may either act alone or consort with the enemy. Tank — a computer operator comparable to a real-world security analyst — eventually kills Cypher. The security analyst defeats the insider threat.

For cybersecurity professionals, insider threats continue to plague organizations of all sizes. Consider these statistics:

Fortunately, malicious insiders who seek to steal data can be neutralized through a robust security program that includes network, endpoint and identity security, and pervasive vulnerability management, and focuses equally on protection, detection, and response.

Battling Cyber Villains Is Our Reality
There are several other parallels between the plot of The Matrix and the cybersecurity world:

  • Zion can be compared with an organization that needs protection.
  • The Nebuchadnezzar's control center is analogous to the security operations center (SOC).
  • Morpheus (Fishburne) is the security-aware CEO who recruits talented information security professionals to his team, ultimately enlisting Neo by offering the red pill (video) to wake him up to "the truth."
  • Trinity (Carrie-Anne Moss) is the "white hat" hacker friend of Neo who actually uses the Nmap scanning tool to help out her team in the second installment, The Matrix Reloaded.
  • The ability of The Oracle (Gloria Foster) to understand the human psyche to create a better Matrix could be compared with user and entity behavior analytics, and her ability to see into the future could be compared with the predictive analytics branch of statistical analysis — a fledgling area in cybersecurity.

The Matrix ushered in a new generation of sci-fi movies and brought back complex, futuristic plotlines that featured a relentless, seemingly invulnerable set of villains. Twenty years later, that theme can feel all too real for security professionals.

The facts remain: Bad actors come in all shapes and sizes, deploying new, sophisticated techniques to penetrate enterprises for any number of malicious reasons. As security professionals, we've taken the "red pill," which means we know how pervasive these threats are — and we've chosen to defend Zion against them.

Related Content:

 

 

 Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Stephen Cox is a technology veteran with nearly 20 years in the IT industry, including 10 years of experience leading software development teams in the security industry. A key player in some of the most influential IT security firms in the world, he is recognized as an ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
alphadata
50%
50%
alphadata,
User Rank: Apprentice
4/27/2019 | 3:21:35 AM
Re: Wonderful, thoughtful essay
When The Matrix came out 20 years ago, the internet was still in its infancy, confined by the limits of dial-up modems, Netscape browsers and the startup discs that EarthLink and AOL tucked in mailboxes across the country. If you wanted to use the internet, you usually had to sacrifice your phone line, and those with constant busy signals were regarded as hopeless shut-ins, like a flannel-swathed

Sandra Bullock ordering a pie from Pizza-dot-net. To the extent that films were thinking about the possibilities of online life, they were usually defined by suspicion and terror, such as the VR corporate sabotage of Disclosure or sick allure of a chatroom IT security companies in dubai sadist in Dee Snider's StrangeLand. The landscape was changing, but all they could think to do was freak out and disconnect.
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
4/8/2019 | 1:29:08 PM
Re: I think you got it backwards
The final battle in the last Matrix is definate ransomware attack or DDoS attack, more liikely the latter.  Flood of dangeroius packets. 

 
nhacailixi88
50%
50%
nhacailixi88,
User Rank: Apprentice
4/5/2019 | 10:45:16 PM
Re: I think you got it backwards
va
schopj
50%
50%
schopj,
User Rank: Strategist
4/5/2019 | 4:37:35 PM
I think you got it backwards
While I think this article is very well written and the analogies work quite well to illustrate your points, in the Matrix however, the computer references are the opposite of your analogies.  The crew of the Nebbakanezzer ARE the hackers.  The agents, are anti-virus platforms and remote admin tools.  Agent Smith, once decommissioned, becomes a self replicating virus as he rebels against the the system that discarded him.  You hit the nail on the head of the Oracle being the AI and Machine learning algorithms, but in the Matrix, Neo is the insider threat, or perhaps the vulnerability itself, the result of an unbalanced binary equation, the 1 that balances out the 0, that one bug that the developers just couldnt get rid of.  
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
4/5/2019 | 12:38:39 PM
Wonderful, thoughtful essay
Your comments are spot-on and probable that more rules and comparisons exist in this series than touched upon, after all almost all cyber work involves a matrix of some kind or another.  Now, if we address IBM, eh, HAL9000 we come upon another variable: the computer system-network at self-fault.  That would be a writing task and as a reader " I have the greatest confidence in the mission." 
97% of Americans Can't Ace a Basic Security Test
Steve Zurier, Contributing Writer,  5/20/2019
How a Manufacturing Firm Recovered from a Devastating Ransomware Attack
Kelly Jackson Higgins, Executive Editor at Dark Reading,  5/20/2019
TeamViewer Admits Breach from 2016
Dark Reading Staff 5/20/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Could you pass the hash, I really have to use the bathroom!
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-9892
PUBLISHED: 2019-05-22
An issue was discovered in Open Ticket Request System (OTRS) 5.x through 5.0.34, 6.x through 6.0.17, and 7.x through 7.0.6. An attacker who is logged into OTRS as an agent user with appropriate permissions may try to import carefully crafted Report Statistics XML that will result in reading of arbit...
CVE-2019-10066
PUBLISHED: 2019-05-22
An issue was discovered in Open Ticket Request System (OTRS) 7.x through 7.0.6, Community Edition 6.0.x through 6.0.17, and OTRSAppointmentCalendar 5.0.x through 5.0.12. An attacker who is logged into OTRS as an agent with appropriate permissions may create a carefully crafted calendar appointment i...
CVE-2019-10067
PUBLISHED: 2019-05-22
An issue was discovered in Open Ticket Request System (OTRS) 7.x through 7.0.6 and Community Edition 5.0.x through 5.0.35 and 6.0.x through 6.0.17. An attacker who is logged into OTRS as an agent user with appropriate permissions may manipulate the URL to cause execution of JavaScript in the context...
CVE-2019-6513
PUBLISHED: 2019-05-21
An issue was discovered in WSO2 API Manager 2.6.0. It is possible for a logged-in user to upload, as API documentation, any type of file by changing the extension to an allowed one.
CVE-2019-12270
PUBLISHED: 2019-05-21
OpenText Brava! Enterprise and Brava! Server 7.5 through 16.4 configure excessive permissions by default on Windows. During installation, a displaylistcache file share is created on the Windows server with full read and write permissions for the Everyone group at both the NTFS and Share levels. The ...