Part 1 | Top 6 Cybersecurity Movies: Where They Got Incident Response Right [and Wrong!]

We love the movies. Indulging in a world of turbocharged wit, superhuman aptitude or speed; making the lofty seem tangible. There is some truth laced with much fiction.

This mask served as the symbol of a global hacking movement from which a documentary was made. Do the films portray the real world of hacking and cybersecurity?

The world of cybersecurity and hacks, for example, has been fed to us in small doses on the silver screen with as many hack myths as cyber intelligence truths. Here’s a look at where our favorite movies were on target—and off the mark—as well as what automation security incident response (SIR) solutions would’ve saved the day.

(1983) WarGames: Mostly … no. But it got us thinking.

The premise. An adolescent hacker kid gets entangled in troubles with the U.S. military when his (dial-up) modem software connects to an actual WW3 simulation computer.

Where WarGames got it wrong. The plot is far-fetched, and although futuristic and exciting for its time, not realistic for 30 years ago or today..

Where it got it right. The scriptwriters actually invested in real-world hacking techniques.

According to an article in the New York Times, the film caught former President Reagan’s attention during his administration, enough for him to inquire into the plausibility for an experienced tech person.

Queries led to interagency memos, which got the ball rolling on studies, which ultimately turned into: NSDD-145 “National Policy on Telecommunications and Automated Information Systems Security.” The report detailed a far darker problem: these high tech and increasingly popular computers were highly vulnerable to interception by foreign powers and terrorists abroad and here in the States.

The inquiry to understand the impact cyber weaponry could wield produced the discovery of a white paper from the 60s called: “Security and Privacy in Computer Systems,” written by Willis H. Ware, head of the computer science department at RAND Corp. at the time.

The takeaway from his essay? Anyone with a modicum of skill could worm into “on-line” unprotected networks and pilfer government documents. Ware is known for uttering these ominous words that still echo in the halls of SecOps history today:

“‘The only computer that’s completely secure,’ Mr. Ware told them with a mischievous smile, ‘is a computer that no one can use.’”

(1995) Hackers: Both Right and Wrong

The premise: Some hackers are blamed for creating and dispersing a virus that will capsize several oil tankers. In this movie, hacking is romanticized for the laymen: the language and the culture is dressed up for Hollywood—e.g. “Hack the planet!”

Where Hackers got it wrong. The career of a programmer is not edgy and fast paced like Angelina Jolie and her tech-guru crew make it out to be.

Where they got it right. As a matter of fact, hackers were able to upend an offshore oil rig in 2014. It turns out tankers are their own Telecom systems with vulnerabilities hackers can leverage to disable collision avoidance; possibly eject cargo; or turnover cargo inventory or GPS coordinates to pirates looking to cover up thefts.

Another ruse in Hackers, “Salami slicing,” is a CyberSec term for rerouting slivers off recurring financial transactions. It’s possible and has occurred in large corporations and in other movies, such as Office Space.

Jeff Brown, Product Manager of Infogix, explains how the “penny shaving” scam may have been more feasible in the 90s but not so much in present day with whole teams dedicated to Information Security. “Today, however, any company with proper controls on its data would spot [an individual’s] fraudulent act immediately. Detecting data discrepancies is the bread and butter of what data-integrity solutions do.”

Some of the other cybercrimes in Hacker include:

• Hacking a TV station: possible

• Activating school sprinklers through the internet: not likely
• Erasing an individual: possible
• Pulling a heist on a server by creating a diversion for multiple connections: plausible, as was the case Operation Payback, circa 2010
• Burying a virus in a garbage file: unlikely with a SOC team monitoring

Many of the scenes in Hacker were limited by the technology of the decade. But security analysts also point out the presence of InfoSec teams, programmers, analysts and engineers working to achieve a formidable defense. Security operations jobs are some of the most valued in the workspace. CyberSec pays incredibly well and the competition is low.

Read more: Rethinking Cybersecurity: The $80K Job With Few Applicants

(1995) The Net: Wrong in details, prophetic in message

The premise. A computer programmer inadvertently discovers a conspiracy, which endangers her and those around her.

Some would say the movie is unrealistic because your internet identity—socially speaking—is literally the only thing you cannot erase; much to the chagrin of many. But again, according to the aforementioned “virtual kill” it’s more plausible to erase someone’s virtual identity than in the 1995 IoT space.

Where The Net got it wrong. “Real viruses are usually covert, burrowing into systems and doing damage before they’re detected,” says one tech writer, after an interview with Todd A. Marks, video consultant and display graphics supervisor for The Net. “Clearly, that’s not very cinematic. When a computer gets a bug in The Net, the screen usually begins to pixelate.”

Marks agreed that’s not how viruses work, it may be cringe-worthy to the cyber savvy but production teams had to illustrate to the audience “‘the eating through the layers of information.’”

Another reviewer noted the cybersecurity application in The Net called Gatekeeper hiding “a big back door that gives its programmers .… access to pretty much everything, since [in the movie] every single company in the world and also the FBI and New York Stock Exchange have been spooked into using it for security.” But instead of cyber warfare to usurp world dominion, its authors only seek to destroy Bullock’s character’s life.

Where The Net got it right. For its time, The Net was an ominous harbinger for how the advances of technology catering to laymen, can be used against us. Bullock’s character was “easily seduced by [the antagonist] because he spied on her describing her ideal man in a chat room, and filled in the details by going through her records. As she says, ‘our entire lives are recorded on computers, from our work to our taste in movies.’” A theme that was extrapolated upon in 2014’s Ex Machina, among other films.

On Hacks & Security IR: Less keyboard hammering, more mindshare and solution

If the movies were right, pounding away on a keyboard would be a prerequisite for hacking and cybersecurity professionals would be nowhere in sight. In truth, it’s the hacking that is plotted quietly, behind closed doors and Security teams that are multiplying in aptitude and technology; rising as a formidable presence against one-off hackers and international cyber threats.

The diverse group of collaborators are presently Sec Ops, IT Ops and NOC executives who meet around the world to discuss the latest trends in incident response and leveraging automation to accelerate resolution.

Get your buzzer or gong ready to judge which movies in the 2000s got hacking and security right and wrong! Stay tuned for part 2 of this article, featuring more popular cybersecurity movies.