Ghost in the Shell - What it can tell us about Cybersecurity

Introduction

Unless you are familiar with anime and manga the title "Ghost in the Shell" (GitS) the title won't mean much so first a brief explanation. GitS is a media franchise which originally started as a serialised manga before being made in to an anime movie which led to it becoming known worldwide. It exits within the genre of science fiction and specially cyberpunk. The themes the series has touched include robotics, sentient Artificial Intelligence (AI), human augmentation, transferring human consciousness to a machine, an individuals identify and more. So what the question within GitS what relates to cybersecurity throughout the series you have the hacking of technically augmented humans, systems, along with themes of information manipulation and surveillance.

 Lessons we can learn from GitS about Cybersecurity:
  1. Tools can be turned against you: One premises of the GitS franchise is a super powerful intelligent combat robot or AI that was effective against any enemy, and then our enemies stole it. Wikileaks alleged that the CIA has lost control of the majority of its hacking arsenal, Stuxnet which originally designed to damage Iranian centrifuges has repurposed to attack other systems. This means we have to be able to design and protect against any tools we developed ourselves because there is always the risk they will be turned against us if they end up in the wrong hands. 
  2. AI is becoming important in cybersecurity: In GitS is used a tool by the characters both humans and machines to operate faster with the benefit of a global field of intelligence and ability to learns, whilst retaining the ability to apply human context to given situation. Ideally this means the role of AI in cybersecurity is to ingest sensor data and provide automated intelligence. This in turn helps humans to react faster and smarter than they could otherwise. A human should always make the final decision by combining human judgement with machine analytics and response automation, decisions and responses can more informed and made almost instantaneously.
  3. Old hacks still work and provide false flags: In the original anime, the protagonists talk about a fictional “HA-3 virus” that the antagonist used in various attacks. They wondered why such a hacker used such an old and basic virus. They proposed that the hacker may have been using this threat as a decoy, to throw them off his tracks, and make them suspect someone else. This is known as a false flag. Modern malicious hackers use old attacks and methodologies all the time. In security research evidence of macro-based malware, PHP web-shells, and old Linux trojans, which are all very old-style malware and attacks. The lesson to learn: don’t just focus on new attacks. Keep your protections and awareness for older cyber threats up to date, since those threats will surely return. 
  4. Car Hacking has gone from Sci-fi to reality: In 1995, the idea that you might hack and take control of a car seemed ludicrous. In fact, cars from that era lacked many of the drive-by-wire and computer systems of modern automobiles, which would make it possible for hackers to affect your braking or steering in the first place. Nonetheless, the original GitS movie prophetically had Major Kusanagi take-over the steering of a car digitally, through her computer connected brain. The lesson here is that Sci-fi has become reality. Cars really have become computers on wheels, often with wireless Internet connections. Researchers have already proven many times that hackers can take-over a car remotely, and cause it to do some pretty dangerous things. We need to realise the “cyber” danger cars now pose and continue to pressure the industry into securely designing these new connected automobiles. 
  5. A basic firewall is not enough: Throughout the original anime, the protagonists talked about their enemies “hacking through high-level barriers” to get to certain things. They never really explain “barriers,” but you can guess they’re probably the analog for firewalls. The lesson here is sophisticated attackers seemed to always get past these basic barriers. In our modern threat landscape, a traditional firewall is nowhere near enough protection. Persistent and motivated attackers have shown they can often find ways to bypass your basic protections. This doesn’t mean firewalls are useless, but it does mean that you should bolster your firewall with other layers of security (IPS, antivirus, advanced malware protection, etc.) to make it harder for bad guys to burst your barriers. 
  6. Smart cities and building automation have privacy repercussions: Though not referred directly in the narrative, the art in both the old and new GitS movies paint a picture of technological advancement and a “connected” world. For instance, the new movie depicts holographic, interactive marketing everywhere. In the original anime, you get the sense that “New Port City” is a Smart city, where the authorities can digitally track cars, aircraft, and people. The original anime subtly coalesces this point in a scene in a parking garage. A protagonists, asks building security to get the weight from the pressure sensors under two cars in the garage, which leads them to realise that more people had snuck into the building than first suspected. On the surface, this scene shows a cool way for them to figure out a mystery, but it also subtly illustrates some of the repercussions of a hyper-connected world. As we have more network-connected sensors, cameras, and devices, we’re sharing more data with the world than we may realise. Sharing this data has inconceivable privacy implications, especially as more and more things get connected. Sure, you might believe that only the good guys will use this data to make our lives better. The problem is, history shows us bad guys use it too. Beyond the privacy issues, these growingly complex technological systems pose new vulnerabilities. The lesson here is it’s fine to embrace technology — it can be used to make life better — but try to stay aware of all the privacy and security repercussions of our increasingly connected world.
Conclusion 
When it comes to cyber threats, how close are we to living in the dystopian worlds depicted in
science fiction media? Thankfully, we're nowhere near the threat levels posed by cyborg assassins and malicious AI systems, but certainly hackers, phishing scams and other threats are as relevant in the real world as they are in fiction. As businesses and Governments around the world strive to confront the cyber threats of today and tomorrow, it's the job of cybersecurity professionals to ensure that some of the more fantastic science fiction visions don’t come to pass. When it comes to cyber security, we don’t want life imitating art.

References

Comments

Post a Comment

Popular posts

Balancing functionality, usability and security in design

Image
Introduction When designing new devices or applications there is a requirement nowadays to consider there functionality, usability and security. While there has been a push through secure-by-design guidelines for security to be built-in from the beginning there are still gaps in implementation and part of these gaps are design considerations of functionality and usability. Part of this that doing security well is hard work, but it should never block useful functionality for the user. Ideally, when security interferes with key software capabilities, the security must be tweaked. The answer should never be to abandon the functionality and certainly not to abandon the security. Though achieving this balance is admittedly not straightforward. This blog post will aim to look at this triad and how they can be balanced and not compromise each other. Defining the Triad in design A triangle can be used to help explain the relationship between the concepts of security, functionality and ea...
Read more

Personal Interest - Unbuilt fleets of the Royal Navy

Image
Introduction Throughout the 20th Century the Royal Navy designed and examined different types of fleets that were never realised either due to budget constraints, arms treaties or the changing nature of war. These are only a few examples of the different types of unbuilt fleets. Some of these had prototypes built and tasted for the Royal Navy which would serve as technological testbeds. Images and info from secret projects forum, shipbucket, popular mechanics/science and naval-matters. Washington Naval Treaty (WNT) The  Washington Naval Treaty  was a treaty signed during 1922 among the major nations that had won  World War I , which agreed to prevent an  arms race  by limiting naval construction. It was negotiated at the  Washington Naval Conference , held in  Washington, D.C. , from November 1921 to February 1922, and it was signed by the governments of the United Kingdom, the United States, France, Italy, and Japan. It limited the construction ...
Read more

Personal Interest - RAF Unbuilt Projects

Image
  Introduction This blog post looks at the different groups of cancelled RAF projects. It will focus on the 50s, 60s, 90s/00s and a brief look at hypersonic research projects. While these projects were often cut or cancelled for budget or austerity reasons, they were also pushed by the changing nature of warfare firstly from conventional style WW2 warfare to the predicated quick, short scale nuclear war which was expected from 1947 to 1989. Later from the 90s and into the 21st Century a change from state on state conflict to facing insurgencies, counter-terrorism and peacekeeping missions again led to a change in how wars are fought. Though the work and research done on these projects would rarely go to waste with it being used and applied in other projects and works even if sometimes it could take another ten or twenty years before anything operational came of that work. There won't be large amounts of text explaining or exploring the designs there are far better sources f...
Read more