History of Cyber Security
Many adults remember a time when their only way to use the internet was to dial in using a loud modem. Many don’t know that the internet, and cyber security, were factors well before that. Companies today often work to minimize cyber attacks to keep consumer and business data, high risk information, and much more safe. To do this, they often need to incorporate cybersecurity.
Where did cyber security start? Understanding the history of cybersecurity may shed some light on just how in depth it is and how important people could be in preventing these risks from occurring.
Where Cybersecurity Began
Cybercrime has evolved significantly since the first computers went online and started communicating with each other. The level of risk faced today is significantly more than it was then, but these threats seem to always have worried computer users, and with good reason.
As technology improves, so may cyber threats. The criminals in the industry often continue to develop new ways to infiltrate and gather information. They may use malware and ransomware to take down everything from meat processing plants to fuel lines running through the country.
Western Governors University
- Earn an IT Degree 100% Online. Flexible IT Programs. Scholarships Available.
- WGU’s degrees in IT are employer-respected and industry-recognized.
- Earn certs with your degree, including CompTIA+, Security+, and A+. 100% online! Programs start monthly – Apply free this week!
A Look at Cybersecurity Risks Throughout Time
Many may think cybercrime began in the last few decades. Yet, computer systems have suffered vulnerabilities for much longer. Cybercriminals have played a role for a long time. Let’s take a decade by decade look at some of the factors impacting the industry.
The 1940s
The first digital computer was created in 1943. For the next several decades, there were limited ways for people to use computers in a criminal or risky manner. There were only a few of these computers located around the world. Most were very large, very noisy, and difficult to use. These electronic machines were not available to most people. Many didn’t know they existed.
What’s more, in the 1940s, there was no interconnecting network either. There was no connection between computers to move data or files. That created, what could be called, a safe climate. Threats were nearly nonexistent.
In the late part of the decade, though, many developed a theory about viruses. John von Neumann believed that some type of “mechanical organism” could occur. It would damage machines. It could copy itself like a naturally occurring virus. And, it could spread to new hosts as well. He developed this theory and wrote about it in Theory of Self Reproducing Automata, a paper he published later in 1966.
The 1950s
Hacking didn’t initially develop as a way to gather information with computers. Rather, the roots of computer hacking may be more effectively linked to early telephone use. This is evident in the 1950s when a trend called phone phreaking began.
Phone phreaks are people that had a significant interest in the way phones worked. They attempted to hijack the protocols in place that enabled engineers to work on the network from a distance. This enabled people to make no cost calls and reduced tolls for long distance calling. This practice continued for some time. It left many phone companies without a way to stop it from occurring.
There are claims that Steve Jobs and Steve Wozniak, the founders of Apple, were interested in the phone phreaks community itself. Digital technology using similar concepts would later be developed in the Apple computers.
The 1960s
The 1960s brought with it various innovations in the computer industry. Still, computers were still very large and expensive systems. Most were huge mainframes that, when used, were locked into rooms far away from access to the general public or anyone else using them.
The term hacking developed during this decade, for the most part. It didn’t come from the use with computers, but rather when a group of people hacked the MIT Tech Model Railroad Club hacked high tech train sets. They wanted to make adjustments to their functionality. That same premise made the move to computers this year.
Still, hacking and gaining access to these early computers didn’t seem like “big business.” In fact, these early hacking events simply aimed to gain access to systems. There were no political or commercial benefits likely to occur, though. Rather, early hacking was more about causing some trouble to see if it could be done.
Over time, new faster, and more efficient ways of hacking developed. One key event occurred in 1967. At that time, IBM welcomed a group of students into their offices to try out a newly designed computer. The students learned about the computer system’s language. They gained access to various parts of the system. This provided IBM with insight into the vulnerabilities of the system.
The result was the development of a defensive mindset, that computers required security measures to keep hackers out. This may have been the first example of ethical hacking in the industry.
This was an important step in the development of cybersecurity strategies. It was turning the latter part of this decade, and even more so in the years to come, that computers became more readily used. They were developed smaller, too. That meant companies could afford them. Many organizations did so, purchasing the technology as a way to store data. As they did, locking the computers in a room didn’t seem feasible or beneficial. Too many employees needed access to work. That’s when the use of passwords for computer access developed.
The 1970s
The true birth of cybersecurity occurred in the 1970s. This began with a project called The Advanced Research Projects Agency Network (ARPANET). This was the connectivity network developed prior to the internet itself.
A man named Bob Thomas determined it was possible for a computer program to move over a network. As it did so, the program would leave a trail as it moved. He developed the program so that it could move between the Tenex terminals on ARPANET.
Mr. Thomas called this program Creeper. Mr. Thomas created the program to carry and print a simple message. “I’M THE CREEPER: CATCH ME IF YOU CAN.”
This sparked a lot of interest and some concern. It was this message that spurred a man named Ray Tomlinson to develop a new program. He called this program Reaper. Tomlinson, who gained fame for his development of email, developed Reaper to chase and delete Creeper.
Reaper is easily the first example of an antivirus software program. It was also called a self replicating program. That made Reaper the world’s first computer worm.
At this time, computer technology continued to grow and expand. Most networks relied on telephone systems for connectivity. That placed a new, higher level of demand on ways to secure networks. Every piece of hardware connected to the network created a new type of entry point. These were vulnerabilities in the network.
The development of security solutions was even more important at this point. Governments began discussing ways to reduce these vulnerabilities. Governments learned that unauthorized access across this large system could create numerous problems. A range of scientific papers were written in the second half of the decade examining ways to provide this security. They also detailed the risks expected to occur.
The Electronic Systems Division (ESD) of the U.S. Air Force Command began working on projects. The Advanced Research Projects Agency (ARPA) was also involved. It was a division of the U.S. Defense Department. Their task was to develop security for the Honeywell Multics (HIS level 68) computer system.
Other organizations began working on network security as well. That includes Stanford Research Institution and UCLA.
The Protection Analysis Project from ARPA was a key component of development. It looked at a wide range of topics. This includes identifying vulnerabilities. It worked on various aspects of operating system security. It also aimed to develop automatable methods for spotting vulnerabilities in software programs. All of these were new topics and insights in the industry.
By the middle point of this decade, a true development of cybersecurity was growing. It was now necessary for computer developers to also focus on creating safe and secure systems.
In 1979, just as the decade was waning, the first cyber criminal was arrested. His name was Kevin Mitnick. He was just 16 years old. He managed to hack into The Ark. The Ark was a massive system that was used for developing operating systems. It was located at the Digital Equipment Corporation. Mr. Mitnick managed to make copies of the software after gaining access to it. He was captured for his actions, arrested, and jailed over the events. He was the first of numerous cyber attacks to occur in the coming decades.
The 1980s
With the advent of cyber attacks present, this decade brought numerous problems for computer networks. Number of high profile attacks would take place in this decade. That includes attacks on AT&T, the Los Alamos National Laboratory, and National CSS. It was in 1983 that new terms were developed to describe these attacks. Among them were “computer virus” and “Trojan Horse.”
A big fear at this time was the threat from other governments. It was the middle of the Cold War. The fear of cyber espionage was very real. That pushed the U.S. government to create new guidelines and resources for managing such events and threats. The Trusted Computer System Evaluation Criteria was developed in 1985 by the U.S. Department of Defense. It was later called The Orange Book.
This guide was valuable as it was one of the first guides to security for computers. It aimed to assess how much trust is put into software that uses any type of sensitive information. It also established some basic security measures that software manufactured need to consider. This would create a foundation from which commercial computer programs were developed in terms of cybersecurity.
The threat was real. A man named Marcus Hess, a hacker from Germany, managed to infiltrate the government’s systems in 1986. He used an internet gateway located in California. To do this, he managed to piggyback onto ARPANET. The result was astounding. In what seemed to be a matter of minutes, he was able to access some 400 military computers. Among those were the mainframes being used by the Pentagon itself. He planned to sell all of the information he gathered to the KGB.
The attack left many companies wondering what to do. Security became a bigger focus from this point on. Information and strategies for mitigating such risks were quickly developed. For example, one big trend was the need to monitor the size of the command.com files being sent. The larger the file was, the more likely it was of a virus or other risk. Of course, that didn’t remain the case.
Another sign was a drop in accessible memory. If that occurred, it could signal an infection on the computer system. Today, a slowdown in a computer is still a sign of malicious activity likely occurring.
In the later part of this decade came the development of the cybersecurity industry. Commercial antivirus products were first developed and released in 1987, just a year after the Pentagon attack.
What’s confusing is knowing who developed the first product. Many claims exist. Some of the most notable to consider include the development of VirusScan, a product developed by John McAfee, who went on to found his own company by the same name. An antivirus product was released for the Atari ST Kai Figge and Andreas Luning. A NOD antivirus solution was released in Czechoslovakia as well.
This year also brought other changes to the industry.
Bernd Fix took on the challenge of the Vienna virus. This virus was one of the first forms of malware to be created. It spread through systems and corrupted files as it went. Mr. Fix was able to remove the virus.
This was also the year of the Cascade virus. This was one of the first encrypted viruses. It moved through and infected .com files. While the virus itself was harsh, it’s also important to mention it because it spurred the development of new antivirus solutions. For example, Cascade managed to infect the computer systems at IBM.
The development of the computer worm also flourished in the 1980s. Some say Robert T. Morris developed it. He was a student studying at Cornwell University and wanted to determine the size of the internet as a whole. To do it, he built a worm in 1988. The worm’s goal was to move through and infect UNIX systems. When infected, it would count the connections present on the web. This, too, was a self replicating virus.
Mr. Morris’s plan did not work well. An error in the design of the program caused it to infect each machine, one after the other. This led to networks that were clogged with information, leading to massive crashes. The program was aggressive and eventually left the internet slowed. What makes this particular event important is that it was one of the first widely publicized events in cybersecurity.
This worm was unique in the way it was written, too. It was the first to exploit system vulnerabilities. Mr. Morris was also the first person to be charged under the Computer Fraud and Abuse Act. The worm he developed led to the development of the Computer Emergency Response Team.
The event also sparked a change in cybersecurity itself. Now, more people were researching how to create deadlier and effective worms and viruses. The more people developing these problems, the more they evolved and became more invasive. To counteract this, there was an increasing need to develop new antivirus solutions that could respond rapidly to these problems.
By the end of the decade, there were numerous antivirus solutions on the market. That includes Norman Virus Control, ThunderBYTE, and F-Prot. IBM also released its previously internally used product to the public. It was one of the first IBM VirusScan and MS-DOS solutions.
The 1990s
The entire decade saw the incredible growth and development of the internet. The cybersecurity industry grew with it. Here are some key developments.
Polymorphic virus risks developed. In 1990, the first code that mutates as it infects people – that also keeps the original algorithm in place – was developed. The polymorphic virus was designed to avoid detection. That made it harder for computer users to know it was there.
The DiskKiller virus was released by PC Today, a magazine aimed at computer users. It infected thousands of computers. The magazine edition offered the disc to subscribers. They stated it was an accident, and they did not know the risk was present.
The first anti antivirus program was developed. It was developed by cybercriminals to circumvent these software programs.
In 1996, stealth capability was developed. This was also the same year macro viruses were released. Both created more challenges and required new developments of antivirus software. From the first antivirus on, the goal was to increase ways to protect against risks. As one hacker group developed after another, companies faced a lot of challenges to improve security to minimize data breaches.
More types of malicious programs were on the way. The ILOVEYOU virus and Melissa infected millions of computers in the 1990s targeting Microsoft Outlook. These viruses caused significant slowdowns and failures of email systems.
At this time, many of the viruses circulating were seeking financial gains. Some aimed at strategic objectives. Yet, there were plenty of instances in which individuals suffered data loss, financial loss, or other risks due to these viruses. Major news reports picked up on this at a rapid pace. That lead to even more pressure to create cyber security solutions. Computer security was big business as a result.
Over the coming years, new strategies were developed to help with growing problems. One of those was Secure Socket Layer. It was developed as a way to protect users who were moving through the internet. Secure Socket Layer (SSL) was put in place in 1995. It helped to protect with activities like online purchases. Netscape developed the protocol for it. It would later be the foundation for the development of HyperText Transfer Protocol Secure (HTTPS).
The 2000s
The growth of the internet was incredible during this period. Computers were in most homes and offices. While this helped consumers, it creates more risks and opportunities for criminals.
Early in the decade, a new type of infection occurred where there was no longer a need to download files. Just going to a website infected with the virus was enough. This type of hidden malware was damaging. It also infiltrated instant messaging services.
The first hacker group also developed at this time. These groups typically include people with specific hacking skills. They may launch a cyberattack campaign for various goals. One of the first to become more recognized when it hacked the Church of Scientology. To do so, it distributed denial of service attacks (DDoS attack). The group, called Anonymous, has continued to create attacks for various high profile targets.
Credit card hacks also occurred in the 2000s. This involved data breaches targeting credit cards. The Albert Gonzales group was of particular importance. This group managed to steal confidential information from 45.7 million credit cards. They gain access through a retailer’s database. This created a broader need to focus on information security by various sectors, including retailers.
Yahoo attacks also occurred during this time. In 2013 and 2014, these came to light. In one situation, more than 3 billion people with a Yahoo account had their accounts hacked. The hackers used spear phishing methods to do so. This created an opportunity through unlimited backdoor access.
State sponsored attacks are another area of concern. The U.S. Central Intelligence Agency (CIA) monitors for these. These attacks put individuals and sensitive data at risk. Many have occurred over the years. One example this occurred in 2014. Then, the Lazarus Group, sponsored by North Korea, took aim at consumers. It hacked into Sony at the time. It resulted in the release of videos for new films, including actor’s images.
While this continued to be an error or intensifying threats, solutions developed, too. New detection methods developed. New solutions for unprecedented threats were created. This included the use of new technology and approaches. Some examples include:
- Computer forensics
- Multi factor authentication
- Network Behavioral Analysis (NBA)
- Real time protection
- Threat intelligence and updated automation
- Sandboxing
- Back up and mirroring
- Multi vector attacks
- Social engineering
- Web application firewalls
The threats from cyber attacks are numerous. They continue to be present. Phishing, personal data loss online, and ransomware attack events take place around the world often. Yet, finding a way to minimize security breaches has become more important than ever.
Artificial intelligence and machine learning are two tools that may find their presence in cyber security growing. The effort to prevent attacks is essential today for many companies. As a result, the need to do so in more profound and effective manners relies on new tech. These are just some of the solutions available. Many new solutions to automate the process may need to be developed. That is why new skill development is so important in the industry. The cybersecurity industry continues to grow and flourish. New technology helps to minimize risks. Staying ahead of the threats is critical. It often takes highly trained professionals in the industry to make that possible.
