Even though fantasy fiction is based on story lines that cannot happen in real life, they can be useful allegories to explain things that are happening in the real world. The zombie apocalypse is one such useful story line as we try to understand the threat of cyber security to today’s businesses and their associated stakeholders.
The Zombie Apocalypse Plotline as an Allegory for the Cybersecurity Threat to your Business
The zombie apocalypse plotline begins with the world falling apart. The survivors are left at a profound disadvantage in the face of the zombie horde. In response they seek a safe place to shelter. In many cases, this pursuit becomes a driver of their journey. This is so common a plot line that it has a genre based name: the Safe Zone Hope Spot. Whether the journey is long or short, the whole movie or just one episode, the outcome is always the same: when they reach the safe place: it wasn’t safe. They find the shelter is overrun, abandoned, and derelict. The zombies always get in!
In Cybersecurity, the Zombies always get in.
The Safe Zone Hope Spot of cybersecurity is the barricade: protection. This hope drives a desire for one tool to solve it all, one lock that will bar the doors. It causes an overemphasis on protection, often to the exclusion of preparation for what to do when the zombies break through or sneak past the barricade.
Common Ways the Zombies of the Cybersecurity Apocalypse Get In
Through the front door using a brute force attack to hammer a known user’s login ID with exponential password guesses until they get it right. The thing is, unlike Leonardo Di Capria fumbling with a key chain in freezing water on the Titanic, today’s threat actors can try all these keys in the lock in a microsecond. Boom, the zombies are in.
The zombies often have helpers inside your system. We call those helpers gremlins. These little mischievous creatures hatch every time something technical gets missed. A security update on a device that wasn’t done. An obsolete piece of kit that represents a rusted-out gate in your perimeter fence. The undeleted, unsecured former user e-mail address that was forgotten. Legacy system protocols from old versions of operating systems that every threat actor on the planet has a skeleton key through which to enter. These maintenance issues represent the unsecured doors and forgotten passages in and around your barricade that let zombies creep through the ceiling and surprise the defenders. Hunting down all these gremlins is hard work.
The characters in the story act really dumb to the audience. They enter dark rooms by visiting websites they shouldn’t. They click on e-mails they shouldn’t. They leave doors open while at Starbucks by signing into public Wi-Fi’s. They leave their keys all over the Internet by reusing passwords at work and home. The zombies always get in, we all need a plan.
Barricades are Important, but They are Not Enough:
Since the zombies always get in, you need a plan to survive when they do. That has three parts:
- Find the gremlins in your systems with good design and proactive maintenance. Remember, gremlins hatch in issues you miss.
- Don’t let your sentries get caught napping. Use up to date tools like artificial intelligence to keep the lights on and look in the shadows. Remember, while your first line of defense is to keep the zombies out, the second line is to detect them when they get in.
- Prepare to survive the fight. While it may be true that no plan survives contact with the enemy, not having a plan means you give the enemy the initiative. You need the ability to shutdown abnormal behavior when detected in your systems, and you need the equivalent of an IT Go Bag to bug out and restore normal operations. These are called Incident Response Plans (IRP).
We Cannot Make You Safe, We Can Only Make You Safer
In the zombie plotline the lead characters are saving their families, in the cybersecurity zombie apocalypse you are saving your business, shareholders, employees, and customers. As an allegory, the stakes are equally high, this is an existential threat for which we must all get ready, because the zombies always get in and we need more than the disappointment of the Safe Zone Hope Spot strategy. We hear of cyber tragedies every day, companies where the Safe Zone Hope Spot didn’t save them.
Being safer is about getting ready. We can help.