What Home Alone teaches us about proactive defense

Earlier this month, I was listening to Adina Bodkins’s Swimming upstream: moving from detection to prevention webinar on-demand and I couldn’t help but draw some parallels between her talk and the classic holiday movie series Home Alone. Maybe it was because she used the infamous meme of Harry’s head ablaze following a thwarted burglary attempt at the McCallister home. Or, maybe it was because I had just watched the original and the sequel back-to-back the night prior (‘tis the season), but it got me thinking: What else could we learn from the bite-sized genius who is Kevin “lamebrain” McCallister?

At first glance, he may seem like an unlikely subject matter expert in proactive security. However, Kevin’s escapades in securing his perimeter and staving off persistent threats are not only worth applauding, but taking note. So, in the spirit of the yuletide, here are six laudable lessons in preventing and defending against adversarial advances courtesy of our favorite pre-adolescent protagonist.

Take stock of your landscape

Just as Kevin McCallister needed to know every nook and cranny of his house to set up booby traps, it’s critical for organizations to be aware of their own digital landscape and the assets that lie within. Asset management is indeed imperative, but it’s not enough to just have visibility these days. You have to know your environment. Baselining endpoints, software, and identities should be the new standard as companies continue to expand toward multi-cloud architecture and AI-generated data. More so, these details will come in handy when it comes to compliance, detection, and response.

Observe and outsmart

In Home Alone and Home Alone 2: Lost in New York, Kevin carefully observes the activities of the burglars and gathers intelligence about their plans. When it comes to security, understanding the modus operandi of a given threat actor isn’t as cut and dry, as it often involves collecting information about their tactics, techniques, and procedures (TTP) from outside sources or postmortem. Red Canary’s annual Threat Detection Report is a great resource for security teams looking for ways to harden their environment against specific threats such as Qbot, Raspberry Robin, or Gootloader (to name a few). Couple that with the open source Atomic Red Team library to test those newly hardened defenses, and those adversaries don’t stand a chance. Below, Adina walks us through what we know about Qbot: the top threat we’ve saw in customer environments last year.

Recalibrate toward prevention

Kevin took preventative measures along the edge of his home to avert the burglars’ mission of stealing the valuables. Perhaps the most harrowing example of this was when Marv steps on what seems like a zillion glass ornaments immediately following his unauthorized entry. While the definition of preventative measures may differ from company to company, Adina says a good rule of thumb is to consider anything that slows down or hinders an adversary from achieving their objective. So, in the context of security, things such as regular software updates, patch management, vulnerability assessments, and Readiness Exercises all fit well within the context of that definition.

The importance of defense-in-depth

Kevin layered various obstacles throughout his home to deter the burglars from advancing. While he knew the “wet bandits” would likely gain initial access, it didn’t stop him from attempting to quell their persistence. Similarly—as Adina mentions in the clip below—it’s necessary to implement a defense-in-depth strategy for detecting and eventually preventing attacks in corporate environments. This involves deploying and testing multiple layers of security measures such as firewalls, EDR, SIEM, MFA, zero trust, etc. to protect against various threats and create hurdles upon entry.

Always have a plan

Kevin always had a plan in case the burglars managed to breach his defenses. It’s also best practice for security teams to develop and regularly update an incident response plan. This plan should outline required steps when it comes to incidents of varying severity (i.e., ransomware, vulnerability exploit, malware on an endpoint), to help minimize damage and downtime while increasing effective communication amid stakeholders.

The value of the unsung hero

In Home Alone 2, Kevin witnesses Marv and Harry robbing Duncan’s Toy Chest and remarks: “Another Christmas in the trenches.” This resonated with me as a defender. Imagine if he hadn’t been there that fateful night? There’s no doubt Kevin saved Christmas in the movie. But, I often ponder what things would look like if we didn’t have vigilant cyber practitioners standing watch. The risks—as we know—are far too great. We’ve heard countless stories of defenders stepping up and responding in the face of adversity; saving networks and protecting data. While we might not have the pleasure of witnessing our adversaries in a shackled walk of shame, know that the bandits of the digital world feel you and there’s a community of Kevins out here that sees you.

So, let’s raise a festive glass of eggnog or Peppermint Schnapps and toast to the boy that has inspired an industry of relentless defenders.

Eat your heart out, Buzz.