Learn

Attacks that changed security

Eight real incidents, from the Morris worm to Log4Shell, and the defence each one forced the industry to adopt.

8 lessons · 50 min

  1. 1The Morris worm and the birth of CERTFreeIn 1988 a student's self-copying program knocked about one in ten internet computers offline, and the response created the first CERT.1988 · 6 min
  2. 2Kevin Mitnick and social engineeringThe most famous hacker of the 1990s often got in by asking. His story is why every company now trains staff to spot a convincing lie.1979–1999 · 6 min
  3. 3Code Red, Slammer and the patch gapTwo fast worms hit flaws that already had fixes. They taught the industry that a patch only protects you once it is installed.2001–2003 · 6 min
  4. 4Stuxnet and attacks on industrial systemsIn 2010 researchers found malware built to change how machines physically ran. It ended the belief that an air gap keeps a plant safe.2009–2010 · 6 min
  5. 5Target, a heating contractor and network segmentationIn 2013 attackers reached the tills of a US retail giant through its air-conditioning vendor. The fix: treat suppliers as risk, and wall off what matters.2013 · 6 min
  6. 6Heartbleed and the code everyone depends onIn 2014 a missing length check in OpenSSL let anyone read a server's memory. It showed how much of the internet rests on a few unpaid maintainers.2012–2014 · 6 min
  7. 7WannaCry, NotPetya and the backup that saves youIn 2017 two worms built on one leaked exploit crippled hospitals and global companies. They made SMBv1, credentials and offline backups board-level topics.2017 · 7 min
  8. 8SolarWinds, Log4Shell and zero trustA poisoned software update and a flaw in a logging library showed that trusted code can turn hostile. The answer was to stop trusting by default.2020–2021 · 7 min