The holidays are coming up, which means you’re bound to catch the family classic film Home Alone 2 on live TV or streaming services at some point.
But what if we switched things up and tried to re-watch it through the lens of “insider threat awareness?” What would we discover? Are there parallels between the insider threat problem and the trials and tribulations of Kevin McAllister and the McAllister family?
[caption id="attachment_6929" align="alignnone" width="960"]
Via IMDB[/caption]
To test this hypothesis, let’s first, lay the groundwork with some defining labels:
- Kevin McCallister = The insider
- Kate, Peter (Kevin’s parents), the rest of the McCallister family, and The Plaza Hotel in New York = The organization
- Marv and Harry (“The Sticky Bandits,” fka “The Wet Bandits”) = Credential thieves
Don’t worry: In case you haven’t watched this movie in 20 years (!), we’ll refresh you on the plot along the way.
For starters, in the first Home Alone, the McCallisters accidentally leave their youngest son Kevin home alone during the holidays. During this time, Kevin discovers that two burglars (Marv and Harry) plan to break in and rob the McCallisters’ home. Kevin then decides to defend his home, using a series of super painful booby traps.
[caption id="attachment_6925" align="alignnone" width="640"]
Via IMDB[/caption]
The organization fails at incident response, yet again
As fate would have it, in Home Alone 2: Lost in New York, the McCallisters lose track of Kevin yet again, this time on a Christmas vacation! The McCallisters, for whatever reason, didn’t learn from the first time around that Kevin has a penchant for being missing when they ask if everyone is accounted for, which is indeed the least effective way to tell when someone is missing. As a result, the family ends up in Florida (their original destination), while Kevin lands in New York City.
But, perhaps fortunately for fans of the first movie (and Macaulay Culkin’s bank account), McCallisters never learned from the behavior of their little insider the first time around. (We won’t discuss Home Alone 3, but let’s just say John Hughes was not involved in that one.)
[caption id="attachment_6920" align="alignnone" width="640"]
Via IMDB[/caption]
Back to Home Alone 2… Kevin decides to make the most of his separation from his family by living it up at The Plaza Hotel with Peter’s credit card (one classic insider threat motivation is emotions-based retaliation). He orders $967 in room service, undetected (which would be relatively cheap at The Plaza by today’s standards, considering how long Kevin was left alone and the sheer amount of food he ordered, but inflation is a topic for another day).
The response time of The Plaza and Peter is incredibly slow when it comes to insider threat detection and investigation. First, it takes the family a figurative (not literal) eon to figure out their son is again missing, and that their credit card bill is fraudulently being racked up at The Plaza. The staff at The Plaza also fails to detect the suspicious activity of Kevin, a solo child repeatedly use a credit card for room service at one of the priciest hotels in New York.
Unfortunately no one told these characters that the longer an insider threat incident remains undetected, the more expensive it typically gets.
The insider unnecessarily invites danger
[caption id="attachment_6923" align="alignnone" width="640"]
Via IMDB[/caption]
Meanwhile, Marv and Harry are very coincidentally break out of prison and find themselves in New York City around the same time Kevin is meeting pigeon ladies and saintly toy store owners. The Bandits plot to rob Duncan’s Toy Chest (remember toy stores?), owned by the aforementioned saintly toy store owner who wants to donate all of the proceeds from his holiday sales to charity.
Kevin meets the toy store owner and learns of the Bandits’ plot to rob him, and for some reason invites the thieves to battle -- both in Duncan’s Toy Chest itself, and in his uncle’s vacant townhouse (does no one call the police in the early 90s?) Once again, Kevin sets a series of booby traps for his favorite gullible villains (staple guns and doorknobs, anyone?) and hilarity ensues.
When the Bandits pursue Kevin into Central Park, they eventually catch him and hold him at gunpoint.The aforementioned pigeon lady gets in on the action, dumping birdseed on the Sticky Bandits (who are shellacked with debris from the previous booby traps), and leaving them as pigeon snacks.
[caption id="attachment_6927" align="alignnone" width="640"]
Via IMDB[/caption]
While Kevin is great at anticipating the moves of the bandits (his external threats), he repeatedly invites trouble and opens himself (and his family) up to risk for no real reason. If he were to have reported the potential incident quickly, the authorities could have responded appropriately.
But let’s face it: we all know that vigilante justice makes for a better movie!
Spoiler alert
The statute of limitations on spoilers has passed on this movie, but just in case you’ve been hiding under a rock, the McCallisters were reunited at The Plaza Hotel and everything ends up being hunky dory, with the exception of the $967 in room service...
What’s Next
If you liked this post, stay tuned for future Reel Insider Threats posts, where we break down popular shows and movies (past and present) through a cybersecurity lens, and attempt to change the way you view them forever.
Subscribe to the Proofpoint Blog