Vulnerabilities / Threats

4/5/2019
10:30 AM
Stephen Cox
Stephen Cox
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
100%
0%

The Matrix at 20: A Metaphor for Today's Cybersecurity Challenges

The Matrix ushered in a new generation of sci-fi movies and futuristic plotlines with a relentless, seemingly invulnerable set of villains. Twenty years later, that theme is all too familiar to security pros.

It's difficult to believe that The Matrix celebrated its 20th anniversary in March. It's equally hard to ignore how well the film has stood the test of time. With Oscar-winning innovations in stunt work and special effects such as "bullet time," the sci-fi epic starring Keanu Reeves and Laurence Fishburne changed Hollywood, according to some film critics.

At least, I think so.

It's not just the special effects and plot development that remain fresh. What's relevant for security professionals is the similarities between the characters and plot and how we look at modern security practices and technology.

The film's protagonist — the computer programmer Mr. Anderson, played by Reeves — is one of billions of humans unwittingly inhabiting a simulated reality, referred to as the "Matrix." Through a process of self-realization and literal rebirth, he becomes the hero, Neo. The process has been triggered by his choice of swallowing a "red pill" of reality instead of the "blue pill" that will keep him ignorantly complacent in a contrived, alternative, and manipulative world.

Neo is analogous to present-day CISOs: security professionals who have taken the "red pill" and are awake to the reality of protecting a real-life business amid the frightening, shape-shifting threats from cybercriminals seeking to do harm. In The Matrix, this ever-present evil is determined to destroy Zion, the last human-inhabited city in the world.

How Neo Battled the 'Advanced Persistent Threat'
Shape-shifting is core to the movie's plot. "Agents," Neo's sinister enemies, take over the bodies of innocent bystanders in their relentless pursuit of Neo and his crew. The cybersecurity analogy here is an advanced persistent threat (APT) group utilizing stolen credentials to gain a foothold into an organization — one of the most pernicious elements facing today's enterprise.

Modern breaches often involve malicious APT-like agents gaining access to an employee's credentials in order to achieve their goal. This usually happens as a result of spearphishing attempts, enabling attackers to steal customer data, intellectual property, or financial and banking data.

Just as Neo stays vigilant in looking for constant threats, CISOs fight the epidemic of stolen credentials with proactive risk-based authentication techniques that stop attackers from even obtaining a foothold in the first place. The key in both situations is having visibility into attacker behavior.

The Battle Against Insider Threats, Matrix-style
As Neo begins his journey to the "real world," a jaded crew member, Cypher (Joe Pantoliano), asks, "Why, oh why, didn't I take the blue pill?" This was Cypher's rhetorical regret for not choosing to accept an easy, stress-free life in the Matrix rather than remaining in his real-world existence. Cypher's words actually foreshadow his true intentions when it's revealed he has sold out the crew on their ship, the Nebuchadnezzar, to the Agents in order to be "reborn" as a rich celebrity in the Matrix — without any memory of his past life.

Cypher represents an insider threat, trading the whereabouts of his crew for his own gain. In cybersecurity terms, insider threats are often embodied by employees, temporary workers, or contractors who have access to an organization's systems. Insider threats may either act alone or consort with the enemy. Tank — a computer operator comparable to a real-world security analyst — eventually kills Cypher. The security analyst defeats the insider threat.

For cybersecurity professionals, insider threats continue to plague organizations of all sizes. Consider these statistics:

Fortunately, malicious insiders who seek to steal data can be neutralized through a robust security program that includes network, endpoint and identity security, and pervasive vulnerability management, and focuses equally on protection, detection, and response.

Battling Cyber Villains Is Our Reality
There are several other parallels between the plot of The Matrix and the cybersecurity world:

  • Zion can be compared with an organization that needs protection.
  • The Nebuchadnezzar's control center is analogous to the security operations center (SOC).
  • Morpheus (Fishburne) is the security-aware CEO who recruits talented information security professionals to his team, ultimately enlisting Neo by offering the red pill (video) to wake him up to "the truth."
  • Trinity (Carrie-Anne Moss) is the "white hat" hacker friend of Neo who actually uses the Nmap scanning tool to help out her team in the second installment, The Matrix Reloaded.
  • The ability of The Oracle (Gloria Foster) to understand the human psyche to create a better Matrix could be compared with user and entity behavior analytics, and her ability to see into the future could be compared with the predictive analytics branch of statistical analysis — a fledgling area in cybersecurity.

The Matrix ushered in a new generation of sci-fi movies and brought back complex, futuristic plotlines that featured a relentless, seemingly invulnerable set of villains. Twenty years later, that theme can feel all too real for security professionals.

The facts remain: Bad actors come in all shapes and sizes, deploying new, sophisticated techniques to penetrate enterprises for any number of malicious reasons. As security professionals, we've taken the "red pill," which means we know how pervasive these threats are — and we've chosen to defend Zion against them.

Related Content:

 

 

 Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Stephen Cox is a technology veteran with nearly 20 years in the IT industry, including 10 years of experience leading software development teams in the security industry. A key player in some of the most influential IT security firms in the world, he is recognized as an ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
4/8/2019 | 1:29:08 PM
Re: I think you got it backwards
The final battle in the last Matrix is definate ransomware attack or DDoS attack, more liikely the latter.  Flood of dangeroius packets. 

 
nhacailixi88
50%
50%
nhacailixi88,
User Rank: Apprentice
4/5/2019 | 10:45:16 PM
Re: I think you got it backwards
va
schopj
50%
50%
schopj,
User Rank: Apprentice
4/5/2019 | 4:37:35 PM
I think you got it backwards
While I think this article is very well written and the analogies work quite well to illustrate your points, in the Matrix however, the computer references are the opposite of your analogies.  The crew of the Nebbakanezzer ARE the hackers.  The agents, are anti-virus platforms and remote admin tools.  Agent Smith, once decommissioned, becomes a self replicating virus as he rebels against the the system that discarded him.  You hit the nail on the head of the Oracle being the AI and Machine learning algorithms, but in the Matrix, Neo is the insider threat, or perhaps the vulnerability itself, the result of an unbalanced binary equation, the 1 that balances out the 0, that one bug that the developers just couldnt get rid of.  
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
4/5/2019 | 12:38:39 PM
Wonderful, thoughtful essay
Your comments are spot-on and probable that more rules and comparisons exist in this series than touched upon, after all almost all cyber work involves a matrix of some kind or another.  Now, if we address IBM, eh, HAL9000 we come upon another variable: the computer system-network at self-fault.  That would be a writing task and as a reader " I have the greatest confidence in the mission." 
Russia Hacked Clinton's Computers Five Hours After Trump's Call
Robert Lemos, Technology Journalist/Data Researcher,  4/19/2019
Tips for the Aftermath of a Cyberattack
Kelly Sheridan, Staff Editor, Dark Reading,  4/17/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-11378
PUBLISHED: 2019-04-20
An issue was discovered in ProjectSend r1053. upload-process-form.php allows finished_files[]=../ directory traversal. It is possible for users to read arbitrary files and (potentially) access the supporting database, delete arbitrary files, access user passwords, or run arbitrary code.
CVE-2019-11372
PUBLISHED: 2019-04-20
An out-of-bounds read in MediaInfoLib::File__Tags_Helper::Synched_Test in Tag/File__Tags.cpp in MediaInfoLib in MediaArea MediaInfo 18.12 leads to a crash.
CVE-2019-11373
PUBLISHED: 2019-04-20
An out-of-bounds read in File__Analyze::Get_L8 in File__Analyze_Buffer.cpp in MediaInfoLib in MediaArea MediaInfo 18.12 leads to a crash.
CVE-2019-11374
PUBLISHED: 2019-04-20
74CMS v5.0.1 has a CSRF vulnerability to add a new admin user via the index.php?m=Admin&c=admin&a=add URI.
CVE-2019-11375
PUBLISHED: 2019-04-20
Msvod v10 has a CSRF vulnerability to change user information via the admin/member/edit.html URI.