Cybersecurity Lessons Learned from 'The Rise of Skywalker'

They're especially relevant regarding several issues we face now, including biometrics, secure data management, and human error with passwords.

Matt Davey, Chief Operations Optimist, 1Password

January 22, 2020

5 Min Read

The Star Wars film franchise has fascinated society with unprecedented fervor for over 40 years, and it's easy to see why: They're Shakespearean tales with lightsabers and spaceships. But aside from timeless lessons about love and friendship and good versus evil, there are tertiary lessons about technology that can be useful for our progression toward a truly safe Internet.

For instance, it's clear that the Empire has unlimited funding, and yet the Rebels manage to sneak in and out of Imperial facilities in every film with light-speed effortlessness. They clearly have the best security in the galaxy, yet are unable to keep a 7-foot-6 Wookiee and his rowdy cohorts from grabbing whatever assets they'd like, time after time. No wonder Darth Vader had anger management issues.

Each Star Wars film has been influenced by the time and events during which it was developed. The cybersecurity lessons learned in Star Wars: The Rise of Skywalker are especially relevant to issues we face today with biometrics, secure data management, and human error with passwords. 

Warning: Spoilers are coming.

(No kidding: You've been warned!)

Betrayal from the Inside
Early in the film, we learn that the First Order has a spy in its midst, supplying the Rebellion with valuable information. After sneaking aboard an Imperial ship (yet again), lead characters Rey, Finn, Poe, and Chewbacca are discovered, and the evil-yet-sensitive villain, Kylo Ren, orders the ship to be locked down. The spy dramatically reveals himself to be General Hux, a top member of the First Order's leadership, who bypasses the lockdown procedures and allows the heroes to make their escape. 

Security protocols are only as good as the individuals who run them. Even the most hardened security can crumble when the bad actor comes from the inside. 

IBM's "Cyber Security Intelligence Index" found that six out of 10 security attacks were carried out by insiders, and of those six attacks, 25% were carried out by "inadvertent actors." In addition to investing heavily in typical security standards, thorough background searches and monitoring for suspicious employee activity can also save an organization time, money, and peace of mind. 

Biometrics: Two-Sided First Order Coin
How did our intrepid heroes manage to sneak aboard the First Order ship? With a First Order Officer's medallion, conveniently provided by friendly scoundrel Zorii Bliss. This medallion makes any spacecraft appear as if it is being operated by an officer in the First Order and allows undetected travel anywhere in the First Order's jurisdiction. 

This medallion reflects the upside and potential downside of biometrics. Biometrics technology is a great convenience and can be immensely secure — you only have one face, after all — but if attackers gain a copy of your fingerprints and face scan, the impact can be disastrous. They're gaining the First Order Officer's medallion to your social media, bank account, 401(k), etc.

If a password is stolen, it can be reset. But if your biometric data is stolen, you can't just change your body to secure your accounts again. Once that First Order coin is getting passed around the rebel fleet, you can never get it back.

Beware storing biometrics data in the cloud and only utilize it for local hardware access. Otherwise, they could be exposed to anyone — and there's no telling what they'll do with it. 

Limiting Potential Gains from a Hack
In order to obtain valuable information about the location of the Sith Temple, C-3PO needed to decode Sith runes found on a stolen knife. However, his operating system wouldn't allow him to divulge the critical information because it could have been used for nefarious purposes. A hacker accessed C-3PO's forbidden memories, but in doing so fully wiped his memory, restoring the iconic bot to his factory settings. That was a smart move on Anakin Skywalker's part because that built-in safety mechanism would dissuade a casual hack, knowing what the cost would be.

The iPhone and other smart devices have implemented similar security protocols. Try accessing an iPhone with the wrong passcode too many times, and the device will have to be reset and wiped to be usable again. That's a brilliant tactic when it comes to safeguarding data. After all, if the hack requires extreme effort for a relatively useless payoff, hackers don't have an incentive to act.

Security companies can go further to design systems that reduce the value of any attack. Using unique passwords for every account, for example, means that a hack only gets attackers into one service — not all of them. Limiting the payoff means hackers will think harder about targeting you in the first place.

Winning the Rebellion
Keeping the bad guys at bay is an eternal fight. When new security is implemented, bad actors inevitably contrive new ways to counteract it. But the Rebellion never gives up — and neither should you. Make sure there are no spies in your midst, don't rely on cloud-based biometrics, and reduce the potential payoff from an attack. Star Wars has always shown us the consequences of even the smallest breaches — paying attention to the details keeps your galaxy safe.

Related Content:


About the Author(s)

Matt Davey

Chief Operations Optimist, 1Password

Matt Davey is the COO (Chief Operations Optimist) at 1Password, a password manager that secures identities and sensitive data for enterprises and their employees. In a previous life working with agencies and financial companies, Matt has seen first-hand how important security practices are at every level in an organization.

After seven years at 1Password, Matt is optimistic about security, and now helps companies roll out layers of security starting with password habits. Matt is a mentor for both the Royal Society of the Arts and Out of Office Hours, helping professionals and newcomers to the industry with all aspects of creating digital products. He is based in Norwich, UK and enjoys failing at baking the most simple of things.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like

More Insights