Defensive Cyber Operations

1988 · 38 years ago

The Morris Worm spread across the early internet and prompted the creation of the first computer emergency response team

An experimental program that spread far faster than its creator intended slowed thousands of connected computers to a halt, leading directly to the founding of CERT/CC at Carnegie Mellon University as a permanent coordination point for reporting and responding to future incidents.

1996 · 30 years ago

Japan established JPCERT/CC, part of a 1990s wave of national incident response teams founded outside the United States

As computer networks spread beyond research and military institutions into wider commercial use, Australia, Japan and other countries built their own coordination centres modelled on the earlier American example, beginning the network of national response teams that later underpinned international incident cooperation.

1999–2000 · 27 years ago

Governments and industry worldwide carried out the first globally coordinated critical-infrastructure resilience effort ahead of the year 2000 date change

Billions were spent auditing and rewriting software across banking, aviation, utilities and government systems to prevent date-related failures, establishing much of the practice of systematic infrastructure risk assessment that later cyber defence regulation built upon.

2003 · 23 years ago

China's Golden Shield Project built a national-scale system for monitoring and filtering network traffic entering the country

Often called the Great Firewall, the system gave China a defensive architecture unlike any other country's, combining content control with monitoring capacity at the scale of the entire national network rather than at individual organisations, a model since studied and partly copied elsewhere.

2007 · 19 years ago

Estonia was hit by weeks of sustained cyberattacks on government, banking and media websites

The attacks followed a diplomatic dispute with Russia over the relocation of a Soviet war memorial and were widely described as the first sustained cyber campaign against an entire country's civilian infrastructure, prompting Estonia and NATO to treat national network defence as a strategic priority.

2008 · 18 years ago

NATO founded the Cooperative Cyber Defence Centre of Excellence in Tallinn

Set up in Estonia a year after the country's own cyberattacks, the centre became the alliance's hub for cyber defence research, training and the legal analysis later published as the Tallinn Manual on how existing international law applies to cyber conflict.

2010 · 16 years ago

The discovery of Stuxnet forced a global reassessment of industrial control system security

Finding that malware could cross from office networks into the specialised control systems running physical equipment such as centrifuges pushed operators of power plants, water systems and factories to treat previously isolated industrial equipment as a genuine target requiring its own defences.

2016 · 10 years ago

The UK established the National Cyber Security Centre, combining intelligence-agency expertise with public-facing defensive advice

Housing the new centre within the signals intelligence agency GCHQ but giving it a public mission to help government, business and the public defend their own networks became a model several other countries later adapted for their own national cyber agencies.

2017 · 9 years ago

The NotPetya wiper spread through a compromised Ukrainian accounting software update to cause billions of dollars in damage worldwide

Disguised as ransomware but designed only to destroy data, the malware crippled shipping giant Maersk, the pharmaceutical firm Merck and numerous other multinational companies within hours, becoming a defining example of third-party software supply-chain risk to corporate network defenders.

2017 · 9 years ago

The WannaCry ransomware worm spread using a leaked NSA-developed exploit and crippled parts of the UK's National Health Service

Unpatched Windows systems let the worm self-propagate across networks worldwide within hours, cancelling operations and appointments across dozens of NHS trusts, until a security researcher's discovery of an unregistered domain acting as a kill switch slowed its spread.

• The episode pushed patch management up the priority list of nearly every large organisation

2017 · 9 years ago

Cyberattack perpetrators stole or impacted two billion data records in six months as ransomware payments doubled

In the first half of 2017, two billion data records were stolen or affected by cyberattacks, while ransomware payments reached US$2 billion, twice the 2016 figure. The scale of losses marked a step change in the threat that defensive cyber operations were expected to counter, and helped drive investment in detection and response capability.

2019 · 7 years ago

Commercial security industry still offered no widely used active defence systems based on increasing system complexity

As of 2019 there were no commercially available, widely used active defence systems that protect systems by deliberately increasing their complexity or variability to make attack harder. This marked a persistent gap in defensive capability, leaving practitioners reliant on conventional monitoring, patching and perimeter defences.

June 2025 · last year

Israel's National Cyber Directorate handled a surge in hacktivist and Iranian-linked attacks around the June 2025 conflict

Water utilities, industrial control systems and government websites faced repeated intrusion attempts and defacement claims during and after the fighting, most of which caused limited disruption, though officials said the volume and persistence of attempted attacks reached unusually high levels.

• Water and energy utilities were repeatedly targeted by low-sophistication hacktivist groups

May 2025 · last year

Australia brought a mandatory ransomware payment reporting requirement into effect

Businesses above a revenue threshold that made a ransomware payment became required to report it to the government under the new Cyber Security Act, intended to give authorities a clearer national picture of ransomware's true scale rather than relying on voluntary disclosure.

2025 · last year

Brazil increased spending on national cyber defence after a wave of ransomware attacks on government systems

Repeated disruption to municipal and federal services pushed budget allocations for detection, response and workforce training higher, part of a broader Latin American pattern of governments treating ransomware resilience as a standing rather than occasional cost.

2025 · last year

The US Cybersecurity and Infrastructure Security Agency faced significant budget and staffing reductions

The cuts, part of a wider reduction in federal cybersecurity spending, drew warnings from former officials and industry groups that state and local governments and smaller critical infrastructure operators would lose a key source of free technical support and threat warnings.

• State and local governments relied heavily on the agency's free assessments and alerts

2025 · last year

South Korea tightened network defences at defence and shipbuilding firms after repeated North Korean intrusions

Government-backed audits and mandatory security upgrades were extended to contractors handling sensitive naval and weapons data, responding to a pattern of espionage that had repeatedly reached design information despite existing protections.

2025 · last year

China's national cyber emergency response teams published further reports attributing intrusions against Chinese networks to US intelligence agencies

Beijing continued a practice, begun in earnest a few years earlier, of publicising detailed technical claims about alleged American hacking of Chinese universities and infrastructure, mirroring the kind of public attribution Western governments had long applied to Chinese state-linked activity.

2025 · last year

South Korean financial regulators set timelines for critical systems to begin migrating to post-quantum cryptography

Following the finalisation of new international post-quantum standards, banks and other operators of essential systems were told to begin planning a transition away from encryption methods a sufficiently powerful future quantum computer could eventually break.

October 2024 · 2 years ago

The European Commission opened infringement proceedings against member states that missed the deadline to transpose the NIS2 cybersecurity directive

The directive extended baseline security and incident-reporting obligations to a much wider range of sectors and firms than its predecessor, and most member states had not finished national transposition by the deadline, leaving the bloc's actual level of protection uneven for months afterward.

2024 · 2 years ago

Singapore widened its Cybersecurity Act to cover cloud services and other critical entities beyond traditional infrastructure operators

Amendments gave the Cyber Security Agency oversight of systems that critical services increasingly depended on even when not owned by the critical infrastructure operator itself, closing a gap regulators said had grown as more essential functions moved to third-party cloud providers.

Late 2024 · 2 years ago

NATO moved to establish an Integrated Cyber Defence Centre to pool member states' network monitoring

The planned centre was intended to bring military, civilian and industry cyber expertise together in one location to speed detection and shared response to attacks on allied networks, building on years of more ad hoc information sharing between national cyber commands.

• Smaller NATO members stood to benefit most from pooled monitoring capacity

2021 · 5 years ago

United Nations member states began negotiating a draft cybercrime treaty

In 2021 UN member states opened negotiations on a draft treaty covering cybercrime. Such an instrument bears directly on defensive cyber operations by shaping the legal basis for attribution, cross-border investigation and prosecution of attackers, who are otherwise rarely brought to account.

2020 · 6 years ago

Remote work during the COVID-19 pandemic drove a sharp rise in hacked and breached data

The global shift to remote working during the COVID-19 pandemic sharply expanded organisations' attack surface, and cybersecurity statistics for 2020 recorded a large increase in hacked and breached data. Defensive operations had to extend monitoring and protection beyond controlled corporate networks to dispersed home environments.