Ghost in the Shell - What it can tell us about Cybersecurity

Introduction

Unless you are familiar with anime and manga the title "Ghost in the Shell" (GitS) the title won't mean much so first a brief explanation. GitS is a media franchise which originally started as a serialised manga before being made in to an anime movie which led to it becoming known worldwide. It exits within the genre of science fiction and specially cyberpunk. The themes the series has touched include robotics, sentient Artificial Intelligence (AI), human augmentation, transferring human consciousness to a machine, an individuals identify and more. So what the question within GitS what relates to cybersecurity throughout the series you have the hacking of technically augmented humans, systems, along with themes of information manipulation and surveillance.

Lessons we can learn from GitS about Cybersecurity:


  1. Tools can be turned against you: One premises of the GitS franchise is a super powerful intelligent combat robot or AI that was effective against any enemy, and then our enemies stole it. Wikileaks alleged that the CIA has lost control of the majority of its hacking arsenal, Stuxnet which originally designed to damage Iranian centrifuges has repurposed to attack other systems. This means we have to be able to design and protect against any tools we developed ourselves because there is always the risk they will be turned against us if they end up in the wrong hands. 
  2. AI is becoming important in cybersecurity: In GitS is used a tool by the characters both humans and machines to operate faster with the benefit of a global field of intelligence and ability to learns, whilst retaining the ability to apply human context to given situation. Ideally this means the role of AI in cybersecurity is to ingest sensor data and provide automated intelligence. This in turn helps humans to react faster and smarter than they could otherwise. A human should always make the final decision by combining human judgement with machine analytics and response automation, decisions and responses can more informed and made almost instantaneously.
  3. Old hacks still work and provide false flags: In the original anime, the protagonists talk about a fictional “HA-3 virus” that the antagonist used in various attacks. They wondered why such a hacker used such an old and basic virus. They proposed that the hacker may have been using this threat as a decoy, to throw them off his tracks, and make them suspect someone else. This is known as a false flag. Modern malicious hackers use old attacks and methodologies all the time. In security research evidence of macro-based malware, PHP web-shells, and old Linux trojans, which are all very old-style malware and attacks. The lesson to learn: don’t just focus on new attacks. Keep your protections and awareness for older cyber threats up to date, since those threats will surely return. 
  4. Car Hacking has gone from Sci-fi to reality: In 1995, the idea that you might hack and take control of a car seemed ludicrous. In fact, cars from that era lacked many of the drive-by-wire and computer systems of modern automobiles, which would make it possible for hackers to affect your braking or steering in the first place. Nonetheless, the original GitS movie prophetically had Major Kusanagi take-over the steering of a car digitally, through her computer connected brain. The lesson here is that Sci-fi has become reality. Cars really have become computers on wheels, often with wireless Internet connections. Researchers have already proven many times that hackers can take-over a car remotely, and cause it to do some pretty dangerous things. We need to realise the “cyber” danger cars now pose and continue to pressure the industry into securely designing these new connected automobiles. 
  5. A basic firewall is not enough: Throughout the original anime, the protagonists talked about their enemies “hacking through high-level barriers” to get to certain things. They never really explain “barriers,” but you can guess they’re probably the analog for firewalls. The lesson here is sophisticated attackers seemed to always get past these basic barriers. In our modern threat landscape, a traditional firewall is nowhere near enough protection. Persistent and motivated attackers have shown they can often find ways to bypass your basic protections. This doesn’t mean firewalls are useless, but it does mean that you should bolster your firewall with other layers of security (IPS, antivirus, advanced malware protection, etc.) to make it harder for bad guys to burst your barriers. 
  6. Smart cities and building automation have privacy repercussions: Though not referred directly in the narrative, the art in both the old and new GitS movies paint a picture of technological advancement and a “connected” world. For instance, the new movie depicts holographic, interactive marketing everywhere. In the original anime, you get the sense that “New Port City” is a Smart city, where the authorities can digitally track cars, aircraft, and people. The original anime subtly coalesces this point in a scene in a parking garage. A protagonists, asks building security to get the weight from the pressure sensors under two cars in the garage, which leads them to realise that more people had snuck into the building than first suspected. On the surface, this scene shows a cool way for them to figure out a mystery, but it also subtly illustrates some of the repercussions of a hyper-connected world. As we have more network-connected sensors, cameras, and devices, we’re sharing more data with the world than we may realise. Sharing this data has inconceivable privacy implications, especially as more and more things get connected. Sure, you might believe that only the good guys will use this data to make our lives better. The problem is, history shows us bad guys use it too. Beyond the privacy issues, these growingly complex technological systems pose new vulnerabilities. The lesson here is it’s fine to embrace technology — it can be used to make life better — but try to stay aware of all the privacy and security repercussions of our increasingly connected world.





Conclusion 


When it comes to cyber threats, how close are we to living in the dystopian worlds depicted in
science fiction media? Thankfully, we're nowhere near the threat levels posed by cyborg assassins and malicious AI systems, but certainly hackers, phishing scams and other threats are as relevant in the real world as they are in fiction. As businesses and Governments around the world strive to confront the cyber threats of today and tomorrow, it's the job of cybersecurity professionals to ensure that some of the more fantastic science fiction visions don’t come to pass. When it comes to cyber security, we don’t want life imitating art.

References

Comments

Popular posts

Personal Interest - Unbuilt fleets of the Royal Navy

A personal interest post - Replacing the Tornado in the RAF

Personal Interest - Cancelled/Unbuilt British Army Projects