The Creeper and Reaper, 1971

The Creeper, which is regarded as the world’s first virus, was a portable code that could travel between Tenex systems. It targeted Digital Equipment Corporation (DEC) PDP-10 mainframe computers connected to the Arpanet, and printed “I’m the creeper: catch me if you can” on the model 33 ASR teletype. The Creeper did not inflect any destructive long term effects on the affected devices.

Reaper is an enhanced self-replicating version of the Creeper which was designed to move through Arpanet deleting copies of Creeper. It is regarded as the world’s first anti-virus program.

The first network freeze, 1988

An inadvertent error in a computer worm code that was designed to gauge the size of the internet resulted in the first DoS attack. The error caused the Morris worm to replicate incessantly to a point that the early internet (Arpanet) was clogged, and 10 percent of all the connected systems crashed. Robert T. Morris, the creator of the Morris worm, became the first person to be charged successfully under the Computer Fraud and Abuse Act.

The Department of Homeland Security, 2002

The United States Department of Homeland Security, established by President George W. Bush in 2002, took on responsibilities to protect the crucial IT infrastructure of the U.S. In 2018, Donald Trump signed into law the Cybersecurity and Infrastructure Security Agency Act which gave rise to the Cybersecurity and Infrastructure Security Agency (CISA). The CISA works with the federal government to defend against cyberattacks.

The birth of Anonymous, 2003

Anonymous, by far the most popular hacktivist group, debuted on the image-based bulletin board 4chan. Anonymous is a decentralized international hacktivist collective which carries out cyberattacks as a means to garner attention to its political views and expose high-profile targets.

Operation Aurora, 2009

Operation Aurora was a series of cyberattacks that originated from China, and targeted the intellectual property information of more than thirty U.S. private-sector companies, including Google, Yahoo, and Adobe. This incident brought to light the capabilities of cyber operations as a tool to carry out large-scale industrial espionage.

Stuxnet, 2010

Stuxnet was an extremely sophisticated computer worm that exploited multiple Windows zero-day vulnerabilities. Allegedly created by a covert U.S.-Israeli program, it targeted and destroyed centrifuges at the uranium enrichment facility in Natanz, Iran, causing substantial damage to the country’s nuclear program.

EternalBlue and ransomware attacks, 2017

EternalBlue is an exploit that utilizes vulnerabilities in the Windows implementation of the Server Message Block (SMB) protocol. It was leaked by the Shadow Brokers hacker group in April, 2017. Two major worldwide ransomware outbreaks, WannaCry and NotPetya, both used this exploit to affect unpatched computers.

General Data Protection Regulation (GDPR), 2018

The General Data Protection Regulation (GDPR) is a compliance regulation that provides citizens of the European Union (EU) greater control over their personal data. Under this mandate, organizations are responsible for protecting the personal data and privacy of EU citizens. The GDPR applies not only to all the organizations operating within the EU, but also organizations outside of the EU that offer goods or services to customers or businesses in the EU. It was approved by the European Parliament in April 2016, and came into force on May 25, 2018.

The Twitter hack, 2020

One of the most sensational cybersecurity incidents this year unfolded as the accounts of numerous high-profile Twitter users were hacked, including those of Barack Obama, Elon Musk, and Bill Gates. The hackers posted fraudulent tweets that read “I am giving back to the community. All Bitcoin sent to the address below will be sent back doubled! If you send $1,000, I will send back $2,000. Only doing this for 30 minutes” and made £86,800 within a few hours. The breach falls in the insider threat category, and whether involving the actions of a malicious insider or negligent employee, proves that humans are the weakest link in the cybersecurity chain.

Remote work – The new norm, more security features coming in 2021

In the wake of the COVID-19 pandemic, most businesses have been forced to adopt a remote work model. While the transition for many organizations has been difficult, indications are that remote work scenarios are likely to remain in place even after the pandemic ends. While there has already been a surge in remote work tools that enable smooth collaboration between teams, the security aspect is rapidly evolving now and will continue in 2021 and beyond. Built-in multi-factor authentication procedures, better encryption techniques, and the use of virtual private networks will become commonplace.

Artificial intelligence (AI) enabled cybersecurity

With efficient machine learning algorithms and seamless integration of AI in cybersecurity applications, real-time threat detection and automated incident response is possible, and is continually being improved. Effective threat correlation engines that detect attacks in their early stages will become more refined as the frontline defense for organizations.

As we look at these milestones in cybersecurity, it becomes evident that the threat landscape is constantly evolving. You might soon see a “All your files have been encrypted. You have 56 hours to submit payment to retrieve your files” message on the very device you are reading this blog. Cyberattacks are no longer a concern for just companies and governments; every individual connected to the internet is susceptible. Cybersecurity is everyone’s responsibility, let’s be watchful and cyber safe!