Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

4/5/2019
10:30 AM
Stephen Cox
Stephen Cox
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
100%
0%

The Matrix at 20: A Metaphor for Today's Cybersecurity Challenges

The Matrix ushered in a new generation of sci-fi movies and futuristic plotlines with a relentless, seemingly invulnerable set of villains. Twenty years later, that theme is all too familiar to security pros.

It's difficult to believe that The Matrix celebrated its 20th anniversary in March. It's equally hard to ignore how well the film has stood the test of time. With Oscar-winning innovations in stunt work and special effects such as "bullet time," the sci-fi epic starring Keanu Reeves and Laurence Fishburne changed Hollywood, according to some film critics.

At least, I think so.

It's not just the special effects and plot development that remain fresh. What's relevant for security professionals is the similarities between the characters and plot and how we look at modern security practices and technology.

The film's protagonist — the computer programmer Mr. Anderson, played by Reeves — is one of billions of humans unwittingly inhabiting a simulated reality, referred to as the "Matrix." Through a process of self-realization and literal rebirth, he becomes the hero, Neo. The process has been triggered by his choice of swallowing a "red pill" of reality instead of the "blue pill" that will keep him ignorantly complacent in a contrived, alternative, and manipulative world.

Neo is analogous to present-day CISOs: security professionals who have taken the "red pill" and are awake to the reality of protecting a real-life business amid the frightening, shape-shifting threats from cybercriminals seeking to do harm. In The Matrix, this ever-present evil is determined to destroy Zion, the last human-inhabited city in the world.

How Neo Battled the 'Advanced Persistent Threat'
Shape-shifting is core to the movie's plot. "Agents," Neo's sinister enemies, take over the bodies of innocent bystanders in their relentless pursuit of Neo and his crew. The cybersecurity analogy here is an advanced persistent threat (APT) group utilizing stolen credentials to gain a foothold into an organization — one of the most pernicious elements facing today's enterprise.

Modern breaches often involve malicious APT-like agents gaining access to an employee's credentials in order to achieve their goal. This usually happens as a result of spearphishing attempts, enabling attackers to steal customer data, intellectual property, or financial and banking data.

Just as Neo stays vigilant in looking for constant threats, CISOs fight the epidemic of stolen credentials with proactive risk-based authentication techniques that stop attackers from even obtaining a foothold in the first place. The key in both situations is having visibility into attacker behavior.

The Battle Against Insider Threats, Matrix-style
As Neo begins his journey to the "real world," a jaded crew member, Cypher (Joe Pantoliano), asks, "Why, oh why, didn't I take the blue pill?" This was Cypher's rhetorical regret for not choosing to accept an easy, stress-free life in the Matrix rather than remaining in his real-world existence. Cypher's words actually foreshadow his true intentions when it's revealed he has sold out the crew on their ship, the Nebuchadnezzar, to the Agents in order to be "reborn" as a rich celebrity in the Matrix — without any memory of his past life.

Cypher represents an insider threat, trading the whereabouts of his crew for his own gain. In cybersecurity terms, insider threats are often embodied by employees, temporary workers, or contractors who have access to an organization's systems. Insider threats may either act alone or consort with the enemy. Tank — a computer operator comparable to a real-world security analyst — eventually kills Cypher. The security analyst defeats the insider threat.

For cybersecurity professionals, insider threats continue to plague organizations of all sizes. Consider these statistics:

Fortunately, malicious insiders who seek to steal data can be neutralized through a robust security program that includes network, endpoint and identity security, and pervasive vulnerability management, and focuses equally on protection, detection, and response.

Battling Cyber Villains Is Our Reality
There are several other parallels between the plot of The Matrix and the cybersecurity world:

  • Zion can be compared with an organization that needs protection.
  • The Nebuchadnezzar's control center is analogous to the security operations center (SOC).
  • Morpheus (Fishburne) is the security-aware CEO who recruits talented information security professionals to his team, ultimately enlisting Neo by offering the red pill (video) to wake him up to "the truth."
  • Trinity (Carrie-Anne Moss) is the "white hat" hacker friend of Neo who actually uses the Nmap scanning tool to help out her team in the second installment, The Matrix Reloaded.
  • The ability of The Oracle (Gloria Foster) to understand the human psyche to create a better Matrix could be compared with user and entity behavior analytics, and her ability to see into the future could be compared with the predictive analytics branch of statistical analysis — a fledgling area in cybersecurity.

The Matrix ushered in a new generation of sci-fi movies and brought back complex, futuristic plotlines that featured a relentless, seemingly invulnerable set of villains. Twenty years later, that theme can feel all too real for security professionals.

The facts remain: Bad actors come in all shapes and sizes, deploying new, sophisticated techniques to penetrate enterprises for any number of malicious reasons. As security professionals, we've taken the "red pill," which means we know how pervasive these threats are — and we've chosen to defend Zion against them.

Related Content:

 

 

 Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Stephen Cox is a technology veteran with nearly 20 years in the IT industry, including 10 years of experience leading software development teams in the security industry. A key player in some of the most influential IT security firms in the world, he is recognized as an ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
alphadata
50%
50%
alphadata,
User Rank: Apprentice
4/27/2019 | 3:21:35 AM
Re: Wonderful, thoughtful essay
When The Matrix came out 20 years ago, the internet was still in its infancy, confined by the limits of dial-up modems, Netscape browsers and the startup discs that EarthLink and AOL tucked in mailboxes across the country. If you wanted to use the internet, you usually had to sacrifice your phone line, and those with constant busy signals were regarded as hopeless shut-ins, like a flannel-swathed

Sandra Bullock ordering a pie from Pizza-dot-net. To the extent that films were thinking about the possibilities of online life, they were usually defined by suspicion and terror, such as the VR corporate sabotage of Disclosure or sick allure of a chatroom IT security companies in dubai sadist in Dee Snider's StrangeLand. The landscape was changing, but all they could think to do was freak out and disconnect.
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
4/8/2019 | 1:29:08 PM
Re: I think you got it backwards
The final battle in the last Matrix is definate ransomware attack or DDoS attack, more liikely the latter.  Flood of dangeroius packets. 

 
nhacailixi88
50%
50%
nhacailixi88,
User Rank: Apprentice
4/5/2019 | 10:45:16 PM
Re: I think you got it backwards
va
schopj
50%
50%
schopj,
User Rank: Strategist
4/5/2019 | 4:37:35 PM
I think you got it backwards
While I think this article is very well written and the analogies work quite well to illustrate your points, in the Matrix however, the computer references are the opposite of your analogies.  The crew of the Nebbakanezzer ARE the hackers.  The agents, are anti-virus platforms and remote admin tools.  Agent Smith, once decommissioned, becomes a self replicating virus as he rebels against the the system that discarded him.  You hit the nail on the head of the Oracle being the AI and Machine learning algorithms, but in the Matrix, Neo is the insider threat, or perhaps the vulnerability itself, the result of an unbalanced binary equation, the 1 that balances out the 0, that one bug that the developers just couldnt get rid of.  
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
4/5/2019 | 12:38:39 PM
Wonderful, thoughtful essay
Your comments are spot-on and probable that more rules and comparisons exist in this series than touched upon, after all almost all cyber work involves a matrix of some kind or another.  Now, if we address IBM, eh, HAL9000 we come upon another variable: the computer system-network at self-fault.  That would be a writing task and as a reader " I have the greatest confidence in the mission." 
Navigating Security in the Cloud
Diya Jolly, Chief Product Officer, Okta,  12/4/2019
US Sets $5 Million Bounty For Russian Hacker Behind Zeus Banking Thefts
Jai Vijayan, Contributing Writer,  12/5/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Our Endpoint Protection system is a little outdated... 
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19719
PUBLISHED: 2019-12-11
Tableau Server 10.3 through 2019.4 on Windows and Linux allows XSS via the embeddedAuthRedirect page.
CVE-2019-19720
PUBLISHED: 2019-12-11
Yabasic 2.86.1 has a heap-based buffer overflow in the yylex() function in flex.c via a crafted BASIC source file.
CVE-2019-19707
PUBLISHED: 2019-12-11
On Moxa EDS-G508E, EDS-G512E, and EDS-G516E devices (with firmware through 6.0), denial of service can occur via PROFINET DCE-RPC endpoint discovery packets.
CVE-2019-19708
PUBLISHED: 2019-12-11
The VisualEditor extension through 1.34 for MediaWiki allows XSS via pasted content containing an element with a data-ve-clipboard-key attribute.
CVE-2019-19709
PUBLISHED: 2019-12-11
MediaWiki through 1.33.1 allows attackers to bypass the Title_blacklist protection mechanism by starting with an arbitrary title, establishing a non-resolvable redirect for the associated page, and using redirect=1 in the action API when editing that page.