It’s May the fourth, Star Wars Day. I don’t know why they call it that. It should be called Day of Vader, but what do people know?
I head up cyber security for Lord Vader. I bet you didn’t think he had a security department. But after his plans for the first Death Star were stolen, he hired me as a DLP consultant. I subsequently conducted vulnerability assessments and red-team tests to ensure we didn’t have any other exposed weak spots that someone could fire a torpedo into to bring the whole house down.
Lord Vader says he senses great potential and has bestowed upon me the title of Darth-CISO.
But despite being an all-powerful intergalactic stakeholder, I still face my fair share of security challenges every day.
Stormtrooper Security Awareness Training
I usually host a breakfast and ask a battalion of storm troopers to come down for some basic training. All too often they end up falling victim to a social engineering trick – all the while making excuses that it was because of the work of some Jedi master.
Stormtroopers are simple-minded and sometime truly infuriating to work with. Just last week, we conducted a test where we dressed up an Ewok in a stormtrooper outfit and sent it into the base. Can you believe that someone held a door open and let him in? I mean, come on! How difficult is it to identify and challenge an Ewok in a costume?
System Tuning
Despite all the blinking lights, our systems can actually be pretty useless at providing critical data. For example, I generally have to spend at least 2 hours every day tuning our radar just so it can tell the difference between a small asteroid and a rebel ship.
One time, when we had landed to burn down a small city, our JDS (Jedi Detection System) started throwing out alerts that it had detected Yoda.
Everyone was all on edge, wondering how that Gremlins reject had found us. However, after a bit of digging, it transpired that it was actually just a large rat that was indigenous to the planet which the JDS had confused for Yoda!
Asset Inventory
Our assets are not static. We have ships, uniforms, blasters, force-fields, and a whole range of other items that need to be fully accounted for and maintained at all times. Prior to my joining, if a trooper lost his blaster in a battle, the paperwork was a nightmare. As a result, we were never sure what our inventory was. It made it easy for any rebel to walk into a base, help themselves to our blasters, armour or even small crafts, and launch an attack.
Since coming on board, however, I’ve introduced a tagging process that helps us keep track of all our critical assets. This allows us to react quickly when an item goes missing, gets destroys or ends up in the wrong place at the wrong time.
Threat Sharing Alliance
I am the chair of the intergalactic threat sharing alliance. I convene and share data with my peers from across the galaxy so that we all have up-to-date information about the latest threats related to the rebels, their movements, their key players, and what kind of ships and technology they are using. This sharing of threat information is invaluable to help us better defend ourselves from the rebels.
Board Meetings
At the end of each day, Lord Vader holds a meeting with his direct reports. Frankly speaking, it’s the hardest hour of the day. He doesn’t care much about process and procedure or how much effort we’ve put in. All he cares about are results.
There is one thing that I particularly don’t like: Lord Vader never listens to my sound reasoning when it comes to assessing risk. Instead, he just tells me to keep trusting my feelings and using the force. This is all well and good when you’re a sith lord, but becomes rather difficult to quantify on a risk matrix.
Maybe one day I’ll be able to convince him otherwise. In the meantime, Lord Vader just force-choked the head of internal audit. This is turning out to be the best day yet!
