Protective Cybersecurity Technologies

April 1967 · 59 years ago

Willis Ware organised the April 1967 session that produced the Ware Report

A session at the Spring Joint Computer Conference organised by Willis Ware, and the subsequent Ware Report, are regarded as foundational moments for computer security as a field. Ware's work spanned material, cultural, political and social dimensions of protecting computer systems. It marked the point at which security became an explicit research concern.

1970s · 56 years ago

IBM and other established computer firms began selling commercial access control systems and security software

By the second half of the 1970s established computer firms such as IBM started offering commercial access control systems and computer security products. This marked the shift of computer security from a purely academic concern to a marketable product category. It created the first commercial security industry.

1971 · 55 years ago

Bob Thomas wrote Creeper, the program generally considered the first computer virus

The experimental program copied itself between computers on an early network, displaying a taunting message as it moved, and prompted another programmer to write Reaper, a program designed specifically to find and delete it, arguably the first antivirus software.

1972 · 54 years ago

Ray Tomlinson created Reaper to destroy Creeper

Reaper was written to seek out and remove the Creeper program from ARPANET machines. It stands as an early instance of countermeasure software built specifically to eliminate hostile code. The pairing prefigured the later antivirus model.

1976 · 50 years ago

Whitfield Diffie and Martin Hellman published the concept of public-key cryptography

Their paper solved the long-standing problem of exchanging a secret key over a channel that might be observed, replacing the assumption that secure communication required parties to share a secret in advance with a method that did not.

1977 · 49 years ago

Ronald Rivest, Adi Shamir and Leonard Adleman published the RSA public-key encryption algorithm

The algorithm let two parties who had never met exchange information securely using a public key that anyone could see and a private key only the recipient held, a breakthrough that underpins secure web browsing, digital signatures and much of modern data protection.

1977 · 49 years ago

NIST introduced the CIA triad of confidentiality, integrity and availability

A 1977 NIST publication set out confidentiality, integrity and availability as a simple framework for describing security goals. The triad became the standard vocabulary for specifying what protective technologies must achieve. More elaborate frameworks have since been proposed but it remains in use.

1986–87 · 40 years ago

A group of German hackers led by Markus Hess carried out the first documented case of cyber espionage

Between September 1986 and June 1987 the group penetrated American defence contractors, universities and military base networks and sold the material to the Soviet KGB. Hess was arrested on 29 June 1987 and convicted of espionage in February 1990. The case established state-sponsored network intrusion as a security problem.

1986 · 40 years ago

The United States enacted the Computer Fraud and Abuse Act

The Act prohibited unauthorised access to or damage of protected computers as defined in 18 U.S.C. § 1030(e)(2). It became the principal American legal instrument against computer intrusion. Its breadth later shaped how researchers could lawfully disclose vulnerabilities.

June 1986 · 40 years ago

IT Security Association TeleTrusT was founded in Germany as an international IT security competence network

TeleTrusT has existed in Germany since June 1986 as an international competence network for IT security. It represents one of the earliest institutional bodies dedicated to coordinating security expertise across borders.

1987 · 39 years ago

John McAfee founded one of the first commercial antivirus companies

As personal computers spread into homes and offices, the new company sold software to detect and remove the small but growing number of viruses circulating on floppy disks, founding an industry that protective cybersecurity technology would grow into over the following decades.

November 1988 · 38 years ago

The Morris Worm spread across a significant share of the early internet

On 2 November 1988 machines among the roughly 60,000 computers then connected to the Internet began slowing down under self-replicating malicious code that consumed processor time and copied itself onward. Released from an American university, the program was intended as an experiment but spread far more aggressively than its author expected, crashing thousands of connected computers. The incident gained major mainstream media attention, made network-borne malware a public policy concern and forced the young internet's operators to treat network security as a serious ongoing problem, spurring incident response capability.

• Carnegie Mellon University established the first Computer Emergency Response Team months later

1993–95 · 33 years ago

Netscape developed and released the SSL protocol for encrypted web traffic

Netscape began developing SSL shortly after NCSA launched Mosaic 1.0 in 1993. Version 1.0 was ready in 1994 but never released publicly because of serious security flaws; Version 2.0 shipped in 1995. SSL became the foundation of encrypted commerce and communication on the web.

1994 · 32 years ago

Unidentified crackers made over a hundred intrusions into the US Air Force's Rome Laboratory

Rome Laboratory was the US Air Force's main command and research facility. The scale of the intrusions demonstrated the exposure of military research networks and pressed the case for hardened defensive measures.

2000 · 26 years ago

UCLA Internet Report documented that data privacy fears were blocking online sales

The UCLA Internet Report: Surveying the Digital Future found more than nine in ten internet users were somewhat or very concerned about credit card security. It established consumer trust in security as a commercial precondition for e-commerce.

2000 · 26 years ago

Vint Cerf coined the term cyber hygiene

The internet pioneer is credited with introducing the phrase, perhaps as late as 2000. It framed routine user and organisational practice, rather than technology alone, as a component of protection.

2003 · 23 years ago

China formally launched the Golden Shield network filtering system

Commonly known as the Great Firewall, the system combined technical filtering with legal requirements on domestic providers to give the state extensive control over what network traffic could cross its borders, becoming the most extensive national internet control system in the world.

2004 · 22 years ago

The US Department of Defense issued DoD Directive 8570 mandating security certifications

The directive, later supplemented by DoD Directive 8140, required all DoD employees and contract personnel in information assurance roles to earn and maintain industry IT certifications. It aimed to guarantee minimum recognised knowledge and skills among those defending network infrastructure. It gave commercial certification schemes such as Security+ and CISSP institutional weight.

2007 · 19 years ago

Estonia suffered weeks of coordinated cyberattacks after a diplomatic row with Russia

Denial-of-service attacks disrupted government, banking and media websites in one of the first sustained cyber campaigns against a single country's civil infrastructure, an episode that led directly to NATO establishing its cyber defence centre of excellence in Tallinn the following year.

2007 · 19 years ago

The United States and Israel began exploiting Windows security flaws to damage Iranian nuclear equipment

The two states used vulnerabilities in Microsoft Windows to attack and damage equipment refining nuclear materials in Iran. In 2010 the resulting Stuxnet worm reportedly ruined almost one-fifth of Iran's nuclear centrifuges. Iran responded by investing heavily in its own cyberwarfare capability, which it began using against the United States.

2009 · 17 years ago

The United States created United States Cyber Command

The command was established as a dedicated military organisation for cyberspace operations, and many other countries have since formed similar forces. It institutionalised national defence of networks as a military function.

2010 · 16 years ago

The Stuxnet worm was discovered after damaging centrifuges at an Iranian nuclear facility

Widely attributed to American and Israeli intelligence agencies, the malware was the first widely documented case of code causing physical destruction to industrial equipment, demonstrating that critical infrastructure controllers once assumed too obscure to attack were a viable and serious target.

2010 · 16 years ago

Canada adopted a national cyber security strategy

Canada has had a cyber security strategy since 2010, with Public Safety Canada planning an evaluation of it in early 2015. It is an example of the spread of national-level strategic frameworks for protective capability.

2013 · 13 years ago

Edward Snowden's disclosures about mass surveillance pushed the technology industry toward encryption by default

Revelations about the scale of government data collection prompted major online services to encrypt traffic between users and servers as standard practice and accelerated adoption of end-to-end encrypted messaging, reshaping the baseline expectation for how much protection ordinary communications should have.

2013 · 13 years ago

Barack Obama signed executive order 13636, prompting the NIST Cybersecurity Framework

Executive order 13636, Improving Critical Infrastructure Cybersecurity, led to the creation of the NIST Cybersecurity Framework. The framework became a widely referenced structure for organising protective controls across critical infrastructure sectors.

2013 · 13 years ago

India's Ministry of Electronics and Information Technology issued the National Cyber Security Policy 2013

The policy framework aimed to protect public and private infrastructure from cyberattacks and to safeguard personal, financial and sovereign data. Provisions were also incorporated into rules under the Information Technology Act 2000 and the Companies Act 2013 imposed cyber security obligations on directors.

2013 · 13 years ago

South Korea committed to training 5,000 new cybersecurity experts

After cyberattacks in the first half of 2013 compromised government, news media, television station and bank websites, the national government pledged to train 5,000 experts by 2017. Seoul blamed North Korea, which denied involvement, as it had for incidents in 2009, 2011 and 2012. The pledge illustrates workforce capacity as a component of national defensive capability.

2015 · 11 years ago

Attackers of the Ukrainian power grid combined spear-phishing and denial of service to disable a power grid

The 2015 Ukraine power grid hack reportedly used spear-phishing, file destruction and denial-of-service attacks in combination. It demonstrated that cyber means could interrupt essential physical services, raising the stakes for protective technology in utilities.

Early 2026 · 6 months ago

Governments and financial institutions across Africa faced a wave of ransomware and hacktivist attacks

Incidents disrupting health, government and banking services in several countries prompted new investment in national computer emergency response teams and cyber defence capacity, though funding and skilled staff remained scarce relative to the scale of the threat.

Early 2026 · 6 months ago

Singapore grew as a regional hub for the cybersecurity industry

Updated rules extending the Cybersecurity Act to cloud and other services, combined with government incentives, drew security vendors and regional headquarters to the city-state, reinforcing its role as a base for cybersecurity operations serving South-East Asia.

March 2025 · 1 year ago

Hong Kong's Legislative Council passed the Protection of Critical Infrastructures (Computer Systems) Bill

The Bill, passed on 19 March 2025, establishes legal requirements for organisations designated as critical infrastructure operators. The resulting Ordinance (Cap.653) and its Code of Practice came into effect on 1 January 2026. It extended mandatory security obligations to operators of essential services.

Early 2025 · last year

North Korea-linked hackers stole roughly a billion and a half dollars in cryptocurrency from an exchange

The theft from the Bybit exchange, attributed to the Lazarus Group, was described as the largest cryptocurrency heist on record, underscoring how state-linked hacking had become a significant source of foreign currency for North Korea despite years of international sanctions and tracing efforts.

Early 2025 · last year

China, Myanmar and Thailand carried out a joint crackdown on cyber-scam compounds

Coordinated raids freed thousands of trafficked workers held in compounds along the Myanmar-Thailand border running online fraud operations, after Chinese public pressure over the scale of citizens lured or trafficked into the schemes forced action against networks that had operated for years.

• The compounds were described as running a global fraud industry

2025 · last year

India tightened cyber incident reporting and data protection rules

Rules implementing the country's data protection law and CERT-In's incident-reporting requirements pushed companies to strengthen breach detection and disclosure, part of a wider effort to build defensive capacity as India became both a growing target and a major source of cybersecurity talent.

Mid-2025 · last year

Japan passed legislation allowing more active cyber defence

The law permitted government agencies to monitor networks and, in some circumstances, intrude on and neutralise servers used to stage attacks against Japanese systems, a significant shift for a country whose cyber posture had long been limited to defence within its own networks.

Mid-2025 · last year

Australia began requiring businesses to report ransomware payments

New rules under the country's cyber security law required certain businesses that paid a ransom after an attack to notify the government, giving authorities a clearer picture of the scale of ransomware payments that had previously gone largely unreported.

Late 2024 · 2 years ago

Chinese state-linked hackers known as Salt Typhoon breached major American telecommunications networks

Investigators found the group had accessed call records and, in some cases, systems used for court-authorised wiretaps at several large carriers. It was among the most extensive intrusions into telecoms infrastructure publicly attributed to a state-linked group and took months to fully evict.

• US officials urged wider use of encrypted messaging in response

Late 2024 · 2 years ago

European Union member states missed the deadline to transpose the NIS2 cyber security directive

Most governments had not finished writing the directive's stricter incident-reporting and risk-management requirements, which cover a far wider range of companies than earlier rules, into national law by the October deadline, leaving businesses uncertain which requirements already applied.

2024 · 2 years ago

The US National Institute of Standards and Technology finalised the first post-quantum cryptography standards

The three finalised standards gave governments and industry an approved set of encryption algorithms designed to resist attacks from a sufficiently powerful quantum computer, starting a long migration of protected systems away from cryptography that quantum computing was expected eventually to break.

• Other governments including China continued developing separate national post-quantum standards

2023 · 3 years ago

Australia adopted the 2023-2030 Australian Cyber Security Strategy

Financial backing forms an integral component of the strategy covering the period to 2030. It is an example of long-horizon national planning for protective capability.

2023 · 3 years ago

The Biden administration released a comprehensive National Cybersecurity Strategy

The 2023 strategy followed the earlier 2018 cyber strategy and Executive Order 14028. It set out a broad national approach to defending American digital infrastructure.

2022 · 4 years ago

The UK government published a National Cyber Security Strategy with £2.6bn funding

The strategy assigned £2.6bn to industry, skills and national security. It tied national protective capability to sustained investment in workforce and industrial base.

May 2021 · 5 years ago

Joe Biden signed Executive Order 14028 on software and federal network security

Issued on 12 May 2021 in response to the Colonial Pipeline ransomware attack, which had shut the largest US fuel pipeline and caused East Coast shortages, the order raised software security standards for government sales. It tightened detection on existing systems, improved information sharing and training, established a Cyber Safety Review Board and reformed incident response.

May 2020 · 6 years ago

The UN Security Council held its second informal meeting on cybersecurity and international peace

On 22 May 2020 the Council met informally to focus on cyber challenges to international peace and security. It signalled the entry of cyber defence into the highest level of multilateral security discussion.

2020 · 6 years ago

The United Kingdom launched the National Cyber Force

The force works with GCHQ and the Ministry of Defence and aims to transform the UK's ability to contest adversaries in cyberspace. It paired defensive institutions with an explicit offensive capability.

2017 · 9 years ago

The US Computer Crime and Intellectual Property Section published a framework for vulnerability disclosure programmes

CCIPS issued A Framework for a Vulnerability Disclosure Program for Online Systems, helping organisations describe authorised discovery and disclosure conduct. The aim was to reduce the risk that such research would be treated as a violation of the Computer Fraud and Abuse Act. It legitimised coordinated disclosure as a protective practice.

2017 · 9 years ago

Attackers deployed multi-vector polymorphic threats that evade security controls

A new class of threats surfaced that combined several attack types and changed form as they spread in order to evade cybersecurity controls. The development pressed defenders beyond static signature-based protection.

2017 · 9 years ago

The WannaCry ransomware spread to more than a hundred countries in a matter of days

Built around a leaked National Security Agency exploit and attributed to North Korea, the worm encrypted data on hundreds of thousands of computers, disrupted Britain's National Health Service among many other organisations and pushed ransomware from a niche criminal nuisance into a first-order national security concern.

December 2016 · 10 years ago

The US Food and Drug Administration issued medical device security recommendations

On 28 December 2016 the FDA published recommendations for how manufacturers should maintain the security of internet-connected medical devices. The guidance came with no enforcement structure. It marked early regulatory attention to connected health hardware.

September 2016 · 10 years ago

The US Department of Transportation announced initial safety standards for autonomous vehicles

The department set out initial safety standards and called on states to adopt uniform policies. It represented the first federal attempt to govern security and safety of self-driving systems.

April 2016 · 10 years ago

The European Parliament and Council adopted the General Data Protection Regulation

The GDPR was adopted on 14 April 2016 and came into force on 25 May 2018, granting individuals in the EU and EEA a right to protection of personal data. It became the reference regulatory regime obliging organisations worldwide to secure personal data.

2016 · 10 years ago

The NSA had its own hacking tools stolen and reused by adversaries

NSA contractors had created and sold click-and-shoot attack tools to US agencies and close allies, but the tools eventually reached foreign adversaries. In 2016 the agency's own hacking tools were hacked, and Russia and North Korea used them. The episode showed how offensive stockpiles can undermine collective defence.

2016 · 10 years ago

GCHQ formed the National Cyber Security Centre

The NCSC was established as the central body overseeing cybersecurity in the United Kingdom, sitting within GCHQ. It concentrated national defensive advice and incident response in one institution.

April 2015 · 11 years ago

The US Office of Personnel Management discovered a breach exposing 21.5 million personnel records

The agency found it had been hacked more than a year earlier, with roughly 21.5 million records stolen. The intrusion was later cited in the 2018 US cyber strategy as justification for hardening government networks.

2015 · 11 years ago

Security researchers remotely carjacked a vehicle from ten miles away

In a widely publicised test, hackers gained access to a car's internal controller area network and drove it into a ditch from a distance. The demonstration forced vehicle security onto the manufacturing agenda; Tesla began pushing security fixes over the air to its cars in 2016.