Zero Trust, Ten-Ton Apex Predators: The Cyber-Security Post-Mortem of Isla Nublar

At some point during Jurassic Park's planning process, somebody approved a facility where losing computer access could result in people being eaten. The meeting minutes would be worth reading. InGen had assessed the commercial potential of live dinosaurs more thoroughly than the consequences of a failed perimeter.

Hammond financed a remarkable genetics operation and built a lavish visitor center around it. Dennis Nedry, a contractor with a grievance, could disable critical park systems from his workstation. Someone approved that arrangement.

This is a fictional incident review of the failures shown in Jurassic Park. InGen never released its network schematics, so the diagrams here are illustrative. Nedry's ability to interfere with the fences, however, requires very little artistic license.

Hammond loved reminding his guests that he'd “spared no expense.” The Chilean sea bass certainly made a persuasive argument. The contingency plan for a fence outage was considerably less impressive.

+-----------------------------------------------------------------------+
|                        INGEN BUDGET ALLOCATION                        |
+-----------------------------------------------------------------------+
|  [||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||]  92%  |
|  Chilean Sea Bass, Ice Cream, & Mahogany Control Room Desks           |
|                                                                       |
|  [|||]  5%                                                            |
|  Actual Dinosaurs                                                     |
|                                                                       |
|  [|]  3%                                                              |
|  IT Infrastructure & Dennis Nedry's Salary                            |
+-----------------------------------------------------------------------+

A lavish visitor center makes a lovely impression on investors. A reliable fallback for the electric fences would have been harder to show off, but it might have kept the T. rex where the brochure said he'd be.

Someone should have asked what would happen if Nedry stopped cooperating. Once he disappeared, the staff had to work out what he'd disabled while the park was already falling apart. Their apparent fallback was finding Dennis, which would have been more promising if Dennis had wanted to be found.

Least privilege is the fairly boring idea that people should only have access to what their jobs require. Nedry had enough authority to interfere with animal containment. An access request involving electrified dinosaur fences probably deserved a longer conversation.

Nedry's departure became a park-wide security incident before anyone noticed he was missing.

      +-------------------------------------------------------+
      |                  DENNIS NEDRY'S TERMINAL              |
      +-------------------------------------------------------+
      |  > sudo disable-security --all                        |
      |  > sudo release-raptors --force                       |
      |  > sudo dump-embryos --format=.cryo                   |
      |                                                       |
      |  [SYSTEM OVERRIDE APPROVED BY: DNEDRY]                |
      +-------------------------------------------------------+
                                  |
            +---------------------+---------------------+
            |                                           |
            v                                           v
+-----------------------+                   +-----------------------+
|   Door Locks: OFF     |                   |  Electric Fences: OFF |
+-----------------------+                   +-----------------------+

Nedry could interfere with the door locks and the fences, with communications also affected. Nobody shown on screen could independently stop those changes. The remaining staff had to work backward from malfunctioning systems to a missing contractor. An unpleasant way to discover your permissions model.

An overpowered admin account is troublesome in an ordinary office. On Isla Nublar, one could interfere with the enclosure holding a Tyrannosaurus rex. The consequences escalated rather quickly.

A fence shutdown should have required independent authorization and local safeguards. One operator could request it, but someone at the enclosure should have had to verify the conditions first. That verification would ideally happen from a position the animal could not reach.

The film doesn't show InGen's network layout, which is unfortunate because I'd love to see who signed off on it. What we do see is an administrative workstation affecting containment equipment. Whatever boundaries existed didn't stop one very unhappy contractor.

+-----------------------------------------------------------------------+
|                          FLAT NETWORK ARCHITECTURE                    |
|                                                                       |
|  [ Guest Kiosks ] <---> [ Lab Embryos ] <---> [ T-Rex Enclosure ]    |
|                                 ^                                     |
|                                 |                                     |
|                                 v                                     |
|                      [ Ice Cream Freezers ]                           |
+-----------------------------------------------------------------------+

A defensible design would establish distinct operating zones:

• Zone 1: Enterprise IT — email, guest registration, and point-of-sale systems
• Zone 2: Research & Genetics — sequencing equipment and embryo inventory
• Zone 3: Industrial Control — generators, paddock power, and perimeter fencing
• Zone 4: Life Safety — emergency communications and shelter access

The ice cream freezers in that diagram are innocent until proven networked. We don't know InGen's actual architecture; we do know Nedry's workstation could affect paddock controls. That's enough to give a security architect a very bad afternoon.

I'd start the architecture review at Nedry's workstation and ask how it could reach the paddock controls. That path should have been restricted, with safeguards that didn't depend on whoever was logged in at the time. The incident suggests InGen had left far too much within his reach.

Jurassic Park used industrial controls to manage equipment that kept animals separated from people. Remote commands could change the state of electrified fences, so access to the control system carried immediate physical consequences.

Software can monitor critical infrastructure and request changes. Removing containment power should have required safeguards that did not depend on the same workstation issuing the request.

POOR DESIGN (InGen's Implementation):
Software Command ---> [Fence Power OFF] ---> Dinosaurs Escape

CORRECT INDUSTRIAL DESIGN:
Software Command ---> Local Controller ---> Hardware Safety Relay ---> Physical Key Interlock ---> [Fence Power OFF]

An independent local controller could have checked whether it was safe to remove fence power. The enclosure also needed a way to keep the animals contained during a central-system failure. Staff evacuation still matters, of course; a fail-secure fence isn't much help if it locks the ranger in with a velociraptor.

• Local hardware validation from an isolated controller inside the paddock substation.
• An independent safety relay reading nominal physical conditions.
• Physical key verification by an on-site ranger.

The film shows no independent interlock rejecting Nedry's shutdown. Nobody at the paddock is shown approving the change before the fences lose power. Given the size of the animals involved, I'd have wanted a second person in that conversation.

The park's electrified barriers lost their deterrent power during the outage. That is a spectacularly poor moment to discover how much your containment strategy depends on a steady supply of electricity.

Door locks and electrified fences have different failure requirements. A lock may need to release so people can evacuate; a containment barrier must still prevent an animal from crossing it. The distinction between fail-safe and fail-secure door hardware helps explain the tradeoff:

• Fail-safe door hardware: unlocks on power loss, which may be necessary for emergency egress.
• Fail-secure door hardware: remains locked on power loss, protecting an entry point but requiring an appropriate egress design.

An electrified fence without electricity is, technically, still a fence. It's simply stopped doing the job InGen was relying on it to do. A second physical barrier would have made that failure much less eventful.

+-----------------------------------------------------------------------+
|                      POWER LOSS CONTAINMENT LOGIC                     |
+-----------------------------------------------------------------------+
|                                                                       |
|   POWER STATUS: ON  ------------> [ Fences Electrified ]             |
|                                                                       |
|   POWER STATUS: OFF ------------> [ Fences De-energized ]             |
|                                   [ Dinosaurs Walk Out ]              |
|                                   [ Humans Get Eaten ]                |
+-----------------------------------------------------------------------+

Backup power would have helped, but generators can fail too. The enclosure needed something that could still contain a Tyrannosaurus rex while the electrical system was out of commission.

InGen had spent heavily on giving visitors a good view of the dinosaurs. During the outage, the visitors got a much closer view than anyone had planned.

Muldoon knew the raptors were testing the fence from the wrong side of it. InGen had a persistent perimeter-security problem, and its adversaries had a particular interest in finding the weak spots.

Muldoon kept telling people the raptors were testing the fences. Unlike a conventional red team, they had no agreed testing window and no intention of submitting a report. He was understandably less enthusiastic about the arrangement than the animals were.

+-----------------------------------------------------------------------+
|                    RAPTOR RED-TEAM PENETRATION LOG                    |
+-----------------------------------------------------------------------+
|  [TEST 01]  North Fence / 08:00 HRS -- Voltage: HIGH -- Result: ABORT  |
|  [TEST 02]  South Fence / 12:00 HRS -- Voltage: HIGH -- Result: ABORT  |
|  [TEST 03]  East Fence  / 21:00 HRS -- Voltage: ZERO -- Result: BREACH |
+-----------------------------------------------------------------------+

Every attempt gave the raptors another opportunity to find a weakness. A human tester could have stopped after documenting the problem. The raptors weren't under any obligation to stop there.

The film doesn't establish whether InGen logged those fence impacts. It does show Muldoon personally tracking the danger. Whatever monitoring existed, it didn't prevent the eventual breach.

The raptors found an opening in the perimeter. Muldoon had been warning the park that they'd keep looking.

Ray Arnold's plan to restart the compromised systems made technical sense. The difficulty was that restoring power meant sending someone to a maintenance location while raptors were loose. That's a rough addition to anybody's on-call responsibilities.

+-----------------------------------------------------------------------+
|                     INGEN EMERGENCY RECOVERY PLAN                     |
+-----------------------------------------------------------------------+
|                                                                       |
|   STEP 1: Flip Main Breaker                                           |
|   STEP 2: Hope the IRIX system boots back up                          |
|   STEP 3: Run through a jungle full of Raptors to reset the switch    |
|   STEP 4: Get eaten in the maintenance shed                           |
+-----------------------------------------------------------------------+

Once the park lost containment, recovery required someone to reach the maintenance shed. The film shows no safer remote fallback. That's a bad time to discover your disaster-recovery plan involves a walk through raptor territory.

The shed may have been perfect for scheduled electrical work. Its location became a much worse idea once reaching it meant walking through raptor territory.

The counting system stopped as soon as it found the number InGen expected. Efficient, if your only goal is to agree with management. Less useful when the unexpected result is a baby dinosaur.

// ILLUSTRATIVE COUNTING LOGIC
if (animal_count == expected_count) {
    status = "NOMINAL";
    stop_counting(); // Expected count reached; scan complete
}

InGen believed reproduction was impossible, so the software treated the expected population as the answer. An extra dinosaur was exactly the sort of discovery that assumption prevented the routine scan from making.

The dinosaurs reproduced anyway. The software continued reporting the expected headcount. Nobody had informed the animals that they were exceeding the approved inventory.

Lex recognized the Unix interface and used the graphical file navigator to restore door access. Good news for everyone in the control room. Less reassuring for anyone responsible for workstation permissions.

+-----------------------------------------------------------------------+
|                 SYSTEM PRIVILEGE ACCESS RECOVERY                      |
+-----------------------------------------------------------------------+
|  USER: LEX_MURPHY (Age 12, Guest)                                    |
|  AUTH: NOT SHOWN IN SCENE                                                  |
|  ACTION: SECURITY-RELEVANT DOOR CONTROLS                   |
|  RESULT: DOOR CONTROLS RESTORED                            |
+-----------------------------------------------------------------------+

Lex restoring the door controls was a relief to everyone in the room. For an incident reviewer, it raises a different question: what sort of access was available on that workstation? The film doesn't show her account or enough authentication detail to prove she had unrestricted privileges.

There wasn't time for an access review while raptors were chasing children. Lex got the doors working. Once everyone was safe, InGen still needed to explain how a guest could complete that recovery path.

The board's incident report could begin with the control failures:

Root cause: Nedry's administrative access could disable safety-critical systems without an independent check. His sabotage brought down containment and made recovery dangerous. Separately, the population-counting logic failed to detect additional dinosaurs.

Hammond found the money to make living dinosaurs possible. What he hadn't bought was a dependable way to recover once the person running the systems stopped cooperating. I would have liked to hear that budget discussion.

Before inviting anyone back, InGen should make sure the next disgruntled contractor can't shut off the fences from his desk.