Cybersecurity Movies: Technically Accurate

Part one of six. Films you can show an engineer without wincing: the tools on screen are real, and the break-in follows the same steps it would follow in life.

They all land on the same point: the machine gets broken far less often than the person.

A team of specialists is hired to test banks for weaknesses. They do it with exactly the methods that still work today: forged badges, a conversation with the guard, the contents of the dumpster behind the office.

Topics: red team operations, social engineering, tailgating through a turnstile, an attack on voice biometrics, cryptanalysis, and what happens when strong encryption stops being strong.

A teenager dials a range of phone numbers with a modem looking for other people's machines and finds something else entirely. After this film, the United States got serious about computer crime legislation.

Topics: wardialing, default and guessed passwords, an undocumented developer backdoor, no separation between test and production environments, automated decisions with no human in the loop.

Technically a series, but it sets the accuracy ceiling for this whole list, so it belongs here. On screen: Kali Linux, Metasploit, Wget, John the Ripper, Raspberry Pi, a USB device posing as a keyboard. Working professionals consulted on it, and the terminal is shown in full, with no invented interfaces.

Topics: phishing and pretexting, attacks on industrial climate control systems, physical implants in a network, botnets, encrypting data for ransom, anonymity and its price, insider threat.

A German story about a group that quickly works out that getting into a protected network is cheaper through a conversation with a person than through the perimeter.

Topics: social engineering in every variety, pulling documents out of the trash, entry through a contractor or a cleaner, the group's own operational security, deanonymization through behavioral traces.

Bletchley Park and the work on Enigma. Cryptanalysis is shown as an engineering discipline: brute force, automation, and the search for a predictable fragment inside a message.

Topics: known-plaintext attack, protocol weakness caused by repeated operator patterns, automating the search, and managing knowledge of a vulnerability: how to use a break without revealing that you have it.

A chronicle of an industry being born: clean-room BIOS cloning, early networks, the first communities and the first attempts to work out who owns user data.

Topics: reverse engineering and its legal limits, the security of dial-up networks, trust in distributed systems, privacy as a product decision.

Next part: based on true events.

The whole series:

1. Technically accurate
2. Based on true events
3. Genre classics
4. Mainstream cinema
5. Documentaries
6. Series