‘Tis the season… cyber-security lessons learned from ‘Home Alone’

It’s that time of year where festive movies dominate our TV screens, and we all have our own favorites – from ‘It’s a Wonderful Life’ and ‘Miracle on 34^th Street’ to ‘Scrooged’ or ‘Die Hard’.

A perennial favorite is of course ‘Home Alone’ which has been running on a loop in my home. For those of you that don’t know the movie it tells the story of seven year old Kevin McAllister who is accidentally left home alone by his parents over Christmas. And with the rest of his family stranded in snow-bound Paris, Kevin is forced to defend the house against career criminals Harry and Marv.

Despite pre-dating the internet, several of the movie’s plot lines offer some important lessons about cyber-security. So, in honor of the festive season, here are three cyber-security lessons from Home Alone.

Lesson one – apply the principle of least privilege: At the beginning of the film the McAllister family is preparing for their departure to Paris the following day. The house is in a state of chaos and Harry, one of the criminals, is in the hallway posing as a police officer wanting to speak with the homeowner to check “to see if everyone’s taking the proper precautions” for the holidays. Placing his trust in the uniform, the dad Peter explains the various security measures they have in place before the mom Kate tells him of their travel plans.

In cyber-security terms the McAllister’s are the victim of a phishing attack – like those we witnessed in the Panama Paper’s data breach and at the BBC this year. Organizations need to pay attention and consider who really needs access to what resources in the organization, and apply the principle of least privilege, giving employees only the degree of access they need to do their jobs. So it one lower-level employee’s credentials are compromised in a phishing attack, the attacker cannot get carte blanche to access all the data held by a company.

Lesson two – don’t underestimate the value of a well configured perimeter: Most of the film is about Kevin laying a series of booby traps aimed at preventing Harry and Marv from stealing from his parents’ home. Much of Kevin’s efforts focus on securing the perimeter of the house with traps including icy steps, a heated door handle, a Bunsen burner rigged to set any intruder on fire and basement steps covered in glue and nails. While these defenses don’t ultimately prevent Harry and Marv from entering the house, the well protected perimeter seriously hampers their progress.

While many have speculated that the firewall is soon to become obsolete, a well configured firewall at the network perimeter remains a key component of any IT security posture. And while a series of firewalls at the outer edge of the network may no longer be enough to counter the modern threat landscape, it is comparable to the basic lock on your door. While for many the front door lock is not enough protection yet wouldn’t leave your front door open when you leave the house. And with Gartner research suggesting that 95% of all firewall breaches are actually caused by misconfigurations, not flaws, it is critical that you properly configure your devices using an automated solution.

Lesson three – good network segmentation is key: In addition to the traps at the outer perimeter of the house, Kevin lays a number of defenses inside the house. These include covering a floor with spare Christmas light bulbs and other fragile glass decorations to make it impassable, and using a tin of paint on a rope to be swung at the hapless thieves, in order to defend the upper floors of the house keep Kevin’s escape route clear.

In short, Kevin segmented the house into zones making it harder for the attackers to move around it.  Network segmentation is a key defense-in-depth security strategy, that restricts access to certain business critical applications and areas of the network that contain sensitive data.  By implementing good network segmentation you will make it harder for any attacker that penetrates your network perimeter to both move around the network laterally and access any business critical data.

By implementing these three key security practices you’ll be sure to significantly improve your organizations security posture and keep the Harry and Marv’s of this world out of your house! Happy holidays!