1 February 2023

Cyber Security Taught By The Movie “Avengers”.

By Rahul Garg

Marvel has been entertaining us for the last 20 years, and nothing better if we still manage to enjoy it with knowledge. So let’s see what Avengers can teach us about cybersecurity.

Come on, I’ll explain…

We’ve seen gods, super soldiers, magicians and other irradiated heroes battle villains on galactic scales.

The eternal struggle of good against evil. That is, as in cybersecurity, ethical hackers fight cyber criminals.

In that sense, if we pick this fun analogy, there’s something useful we can learn from these avengers movies and cybersecurity.

Table of Contents

The villains who end the world always come in an army.

When we watch the Avengers movies, the first thing we realize is that the great villains never fight alone. For example, think of Ultron and his army of bots, Thanos or Loki with the Chitauri. Incidentally, they all come with large armies of generic clones that the heroes must fight before reaching the final boss.

Likewise, serious cyber attacks are planned and executed by organized and structured groups of cyber criminals. Like APT groups, sometimes with hundreds of members. From there we have already managed to extract a lesson from the avengers in cybersecurity.

In real-life scenarios, attacks come from one or more IPs that have been stolen, hacked, or purchased by the criminals. IPs are your faceless proxy army and if you want to get to the invaders, you first need to burn down this IP army.

As if it were easy, isn’t it? But who said being a good hacker is easy!

So how to do this?

You can fight them alone and fail. Or you can team up with other superheroes like the Avengers do, and then, you can have a chance to fight back and even come out a mythical and victorious being.

But let’s not stop there, there is much more to come. And if you want to know about more cybersecurity movies then just have a look at this top hacker movies article .

How to team up and leverage crowd collaboration and intelligence like the avengers in cybersecurity.

This means sharing information about attacks, for example. Most attacks leave tracks. On different systems, services or application logs that can provide indications about attacker IPs and types of attacks.

So sharing all this with other users can help with preemptive remediation if these IPs show up in other people’s logs. Here’s another tip we took from the avengers for cybersecurity.

In that sense, imagine this: Ultron’s minions IPs attack your server. And your IDS detects your activity in your logs, and if you have an efficient IPS, you can stop those IPs from doing more harm to you and the good guys.

But how about you share these Ultron IPs with your neighbor?

And with your family and friends?

Or with all the other people living on Earth?

However, what if every person on Earth blocks these evil IPs as a prevention?

Ultron’s army cannot deal more damage. All they can do now is stop conquering Earth or build a new army.

But in any case, you won. Anyway, all this because of the power of the crowd.

It wasn’t easy, but the victory was good, neh!

Now comes the fun part!

Iron Man Didn’t Defeat Thanos Alone

Let’s take a closer look at the Avenger team roster. You all know their names and respective powers. But what does each of the avengers have in terms of cybersecurity.

By the way, have you thought about how they complement each other?

Hulk is the tank, Thor the strong pitcher. Captain America is the strategist and can do some damage if needed. Iron Man specializes in ranged attacks. Hawkeye is the shooter that never fails. And the widow, the perfect spy. That way they all bring different abilities and powers to the table, making the team very efficient and cool.

But back to cybersecurity. There are many tools that can help prevent attacks. However, some may be effective in specific situations, but there is no one ring to rule them all, oops, wrong universe.

An EDR solution can protect your endpoints, but it won’t be helpful in fighting a DDoS. A SIEM tool will help you centralize intelligence, but it will not help you actively fight malicious activities. An IDS detects funky things in progress in the logs, but won’t act on them.

Like the Avengers, you need a team of solutions that work well together and cover as many cybersecurity scenarios as possible.

First, you need to detect and act. That is, choosing an IDS is an IPS. That combines with a CTI to obtain third-party data to enrich its threat database.

Incidentally add some cybersecurity skills to operate efficiently. That way you get the most efficient combination to combat threats.

Well, that takes work. The interface of these tools certifies that data is flowing efficiently between all these components. This can be a challenge, but in the end, it’s very rewarding.

From Avengers to real-life cybersecurity heroes.

Now, let’s get to the point that makes such a difference in life whether here on Earth or on another planet. For as we are already tired of knowing union is strength!

The crowd intelligence and the integrated solution. That was the idea behind the creation of CrowdSec.

Is not it!

Cybersecurity is an asymmetrical game where attackers always have the initiative, but that’s why avengers are there. In short, cybercriminals make the problem difficult to solve for most companies and people. Also, you can throw money or technology at the problem, but nothing will guarantee its effectiveness.

It’s like that in life, you can’t be sure of anything…

CrowdSec is proposing something new, something that has never been tried before on this scale. A collaborative IPS and IDS that uses crowd intelligence to block attacks. Collaboration between users to create an IP reputation database. And curated to ensure users are protected in real-time from this world’s Ultrons and Thanoses.

Thus, users contribute signals of suspicious IP activity flagged. It could be anything from brute force to credit card stuffing or scalping via DDoS. Which regularly receive an updated block list of IPs that must be fired on sight if they appear in the logs.

Think!

Cybersecurity Waze.

That’s it!

Anyway, if the attackers hide behind IPs. If we as a community can burn these IPs, the attackers will run out of ammo and retreat.