Jurassic Park
I am not a huge fan of dinosaurs, but from the moment I first saw it in the theatre, Jurassic Park has been my all-time favorite movie. Did you realize that none of the tragic second half of the movie would have happened had it not been for the actions of Dennis Nedry? You can talk about “life finds a way” all day long, but in reality, if it had not been for Nedry, things would not gone bad like they did.
Let me step back for a moment. For those who may not have seen the movie (or read the excellent book, which is of course slightly different than the movie adaptation) here is a short plot summary. John Hammond, the owner/CEO of a company called InGen, created a park in which Dinosaurs had been genetically engineered and brought back to life using sophisticated DNA extraction and gene sequencing techniques. Hammond wished to created an experience that was part zoo, part Disney World, where the main attraction would be a ride in which the park guests can view these Dinosaurs.
Before the opening of the park, there was a serious accident (a worker was devoured by a velociraptor), and the park’s investors became concerned that the park would be unsafe for guests. As such, in an effort to put the investors minds at ease, Hammond brought in two of the “top minds” in palaeontology to tour the park and give it their blessing. The lawyer representing the investors also brought to the park his own expert, Ian Malcolm. Malcolm, played by Jeff Goldblum, was a mathematician who specialized in Chaos Theory.
Jurassic Park was extremely automated, using a very sophisticated computer system (for its time) where the phones, rides, and even the fences were all networked. The engineer behind this automation was their “IT guy”, for lack of a better word, Dennis Nedry. There was a problem. Nedry apparently had some financial problems, at least that is what can be assumed based on a conversation that he had with Hammond during the movie. As such, he had secretly made a deal with a rival company to steal embryos from the park in exchange for a very large sum of money.
In order to pull off this theft, Nedry engineered an 18 minute window for himself, during which time he could shut off various park systems in order to steal the embryos and make his escape without getting caught. The result of Nedry's plan (it didn't help that a tropical storm system hit the park at the same time Nedry acted on his plan) was all hell breaking lose in the park, whereby many people were eaten and injured by the dinosaurs, who had escaped since Nedry shut off the park's electric fences.
We have learned, based on the summary above, that Nedry was a shady character. His actions ultimately perpetuated the chain of events that caused many deaths and the subsequent failure of the park. It is the perfect case of insider threat, and this movie should be required viewing for any information security professional.
But why?
For starters, Nedry was a single point of failure. Based on what was stated and implied in the movie, the whole automation of the park, from system administration down to debugging millions of lines of code (application development), rested solely on his shoulders. As such, Hammond certainly did not employ the concept of separation of duties. Separation of duties is defined as the requirement of dividing job duties among people to limit the possibility that any one person could steal information, commit fraud or sabotage something without the cooperation of another.
Hammond did not see the signs. When he and Nedry would get into “financial debates”, Hammond should have suspected that Nedry could become a bad actor, and Hammond should have taken the necessary steps to mitigate this risk. Hammond could have given Nedry a raise, for example. However, since appeasement is no guarantee to mitigate the risk of insider threat, the park should have also instituted a system of monitoring and logging (that Nedry could not have disabled), appropriate software development practices (so Nedry could not have planted backdoors and or logic bombs in the code), better system administration practices (“You didn't say the magic word”), as well as more appropriate physical security of the facility.
In the end, the park's failure was ultimately caused by a lack of separation of duties. (A tropical storm did not help either, as it provided Nedry with a perfect cover.) Nedry was the only person who could get the park back on line, but this scenario could have been prevented. If you want to read more about how you can mitigate the risk of insider threat in your organization, I would encourage you to read this paper from CERT.