Evolution of Cyber Security

Evolution of Cyber Security

Era 1 — The Pre-Internet Era (1960s–1980s)

Computers in this era were large mainframes accessible only to universities, research labs, and the military. There was almost no networking — computers were mostly standalone. Security was purely physical: lock the room, only trusted people get access.

The first known computer "worm" — not a security threat but a self-replicating program — was the Creeper program (1971), created on ARPANET (the predecessor to the internet). It moved from computer to computer and displayed "I'm the creeper, catch me if you can!" The first "antivirus" — called Reaper — was written to delete it.

Era 2 — The Early Internet Era (1988–1999)

ARPANET grew into the public internet. Email, websites, and online communication became widespread. With connectivity came the first wave of real cyber threats.

The Morris Worm (1988) was the first major internet attack. Created by Robert Tappan Morris, it infected ~6,000 computers (about 10% of the entire internet at the time), caused millions of dollars in damage, and led to the creation of the first Computer Emergency Response Team (CERT).

During the 1990s, antivirus software became a commercial product, firewalls were introduced, and basic password-based authentication became standard.

Era 3 — The Dot-Com and E-Commerce Era (2000–2007)

The internet exploded. Online banking, e-commerce, and email became everyday activities. Criminals recognized the financial opportunity — cybercrime shifted from curiosity-driven hacking to profit-motivated attacks.

• Credit card fraud, phishing emails, and identity theft emerged as major threats
• The ILOVEYOU virus (2000) spread via email and caused $10 billion in damage worldwide
• SSL (Secure Sockets Layer) encryption was introduced for secure online transactions
• Governments started creating cybercrime laws (India's IT Act 2000)

Era 4 — The Advanced Persistent Threat Era (2008–2015)

Attacks became more sophisticated, targeted, and organized. Nation-states started using cyberattacks as a tool of warfare. Organized criminal groups operated like businesses — with specializations, customer support (for ransomware victims), and profit-sharing.

Stuxnet (2010) — believed to be created by US and Israel — became the world's first known cyber weapon. It physically destroyed Iran's nuclear centrifuges by sending incorrect commands to industrial machines. This proved that cyberattacks can cause real physical destruction.

Era 5 — The Modern Era: AI, Cloud & IoT (2016–Present)

Today's threat landscape is the most complex in history. Three technology revolutions have dramatically expanded the attack surface:

• IoT (Internet of Things): Billions of smart devices — fridges, cameras, industrial sensors — connected to the internet with minimal security
• Cloud Computing: Sensitive organizational data moved to cloud platforms that can be misconfigured and exposed
• Artificial Intelligence: Both attackers and defenders now use AI — AI-powered malware that adapts to evade detection, and AI-powered security tools that detect threats in real time

Cyber Security: Increasing Threat Landscape

Why is the Threat Landscape Expanding?

1. More Devices = More Targets

Every new device connected to the internet is a new potential entry point for an attacker. In 2010, there were about 12.5 billion internet-connected devices. By 2025, this number crossed 75 billion devices — including smartphones, smart TVs, industrial sensors, medical equipment, and vehicles.

2. Ransomware Explosion

Ransomware attacks grew by 150% between 2020 and 2022 (IBM X-Force). Attackers now offer "Ransomware-as-a-Service" — even non-technical criminals can buy ransomware kits and launch attacks. Hospitals, schools, and governments are prime targets because they desperately need their data and will pay quickly.

3. Cloud Misconfigurations

Organizations moved to cloud platforms (AWS, Azure, Google Cloud) quickly — but many misconfigured their storage. A "publicly accessible" S3 bucket in AWS can expose millions of files to anyone on the internet. According to IBM, cloud misconfiguration is responsible for 15% of all data breaches.

4. Phishing and Social Engineering

Phishing is now highly targeted. Attackers research victims on LinkedIn, Instagram, and company websites, then send convincing personalized emails pretending to be a trusted person. 91% of all cyberattacks begin with a phishing email (KnowBe4, 2023).

5. Supply Chain Attacks

Instead of attacking a well-defended company directly, attackers compromise a small, trusted software vendor that the company uses — and deliver malware through a legitimate software update.

6. AI-Powered Attacks

Attackers now use AI to: write more convincing phishing emails (using ChatGPT-like tools), create deepfake videos of CEOs authorizing fraudulent wire transfers, automatically discover software vulnerabilities, and make malware that changes its code to avoid antivirus detection.

Introduction to Cyber Security

Key Definitions

Cyber Security (NIST Definition)

"The prevention of damage to, protection of, and restoration of computers, electronic communications systems, electronic communications services, wire communication, and electronic communication, including information contained therein, to ensure its availability, integrity, authentication, confidentiality, and nonrepudiation."

Simple Definition

Cyber security is like a security guard system for the digital world — it protects your data, devices, and networks from theft, damage, and unauthorized access, just like a lock and security camera protect your home.

Core Goals of Cyber Security

Cyber security aims to protect three core properties of information — remembered as the CIA Triad (covered in detail in Topic 1.4):

• Confidentiality: Only authorized people can see the data
• Integrity: Data is accurate and has not been tampered with
• Availability: Data and systems are accessible when needed

Domains of Cyber Security

Cyber security is not just one thing — it covers multiple specialized areas:

Types of Cyber Attacks (Overview)

Why is Cyber Security Important Today?

• Everything is digital — banking, healthcare, education, government services all run online
• A single successful cyberattack can cause financial ruin, reputational damage, and legal liability
• Global cybercrime damage costs are expected to reach $10.5 trillion annually by 2025 (Cybersecurity Ventures)
• Cyber security is now considered a national security priority by every major government

Confidentiality, Integrity, and Availability — The CIA Triad

1. Confidentiality

Simple Definition: Only the right people can see the right information. Unauthorized people should never be able to read sensitive data.

How to Achieve Confidentiality?

• Encryption: Convert data into unreadable code. Only someone with the correct key can decode it. (e.g., WhatsApp uses end-to-end encryption)
• Access Control: Assign permissions — only authorized users can open a file (e.g., only the doctor can view patient records)
• Authentication: Passwords, PINs, biometrics to verify identity before granting access
• Multi-Factor Authentication (MFA): Require two or more proofs — password + OTP + fingerprint

How is Confidentiality Violated?

• Data theft — stealing a database of user passwords
• Eavesdropping — intercepting an unencrypted network connection
• Phishing — tricking a user into revealing their password
• Shoulder surfing — physically watching someone type a password

2. Integrity

Simple Definition: Data must be accurate, complete, and unchanged from its original form. No one should be able to modify data without authorization, and any modification should be detectable.

How to Achieve Integrity?

• Hashing: A mathematical function (SHA-256) creates a unique "fingerprint" of a file. If even one character changes, the hash changes completely — detecting tampering
• Digital Signatures: Prove the data came from who it claims and has not been changed
• Version Control: Track all changes to files/code with timestamps and author info
• Input Validation: Prevent malformed or malicious data from being saved to databases
• Audit Logs: Record who changed what, when, and from where

How is Integrity Violated?

• SQL Injection — attackers modify database records
• Man-in-the-Middle attack — attacker intercepts and modifies a transaction
• Malware — changes system files to hide its presence or cause damage
• Insider tampering — an employee modifies financial records for fraud

3. Availability

Simple Definition: Authorized users must be able to access systems, networks, and data whenever they need it. If a system is unavailable when needed, it's just as damaging as a theft.

How to Achieve Availability?

• Redundancy: Multiple backup systems so if one fails, another takes over (e.g., multiple servers, backup power generators)
• DDoS Protection: Services like Cloudflare absorb massive traffic floods to prevent servers from crashing
• Regular Backups: Maintain current, tested backups so systems can be restored quickly after attack
• Load Balancing: Distribute traffic across multiple servers to prevent any single server from being overwhelmed
• Disaster Recovery Plan (DRP): A pre-planned process for restoring systems after a major failure or attack

How is Availability Violated?

• DDoS attack — flooding a server with traffic until it crashes
• Ransomware — encrypting all files so the system is unusable
• Power failure without backup systems
• Physical destruction of hardware

Summary: CIA Triad at a Glance

Security Management, Frameworks and Standards

Why are Security Frameworks Needed?

• Without a framework, security becomes a patchwork of random tools with no coherent strategy
• Frameworks ensure all security areas are covered — not just the obvious ones
• They help organizations prove compliance to regulators, auditors, and customers
• They provide a common language for discussing security across departments and organizations

Major Security Frameworks

1. NIST Cybersecurity Framework (NIST CSF)

Developed by the US National Institute of Standards and Technology. Arguably the most widely used cybersecurity framework in the world. Organized around 5 Core Functions:

Who uses it? US federal agencies, healthcare organizations, banks, IT companies globally. NIST CSF v2.0 was released in February 2024 and adds a 6th function: GOVERN.

2. ISO/IEC 27001

An international standard published by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). It specifies requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS).

Organizations can get certified against ISO 27001 by an accredited certification body. This certification tells customers, partners, and regulators that the organization has a robust, verified security management system.

• ISO 27001 has 114 security controls (in Annex A) covering 14 domains including access control, cryptography, physical security, and incident management
• Complemented by ISO 27002 (implementation guidance) and ISO 27005 (risk management)

3. COBIT (Control Objectives for Information and Related Technologies)

Developed by ISACA (Information Systems Audit and Control Association). COBIT is primarily an IT Governance framework — it helps organizations align their IT strategy with business goals while managing risk and ensuring compliance.

COBIT 2019 (current version) organizes governance into 6 principles and covers domains like: Plan & Organize, Acquire & Implement, Deliver & Support, Monitor & Evaluate.

Who uses it? Large enterprises, auditors, IT governance teams, and financial regulators.

4. PCI-DSS (Payment Card Industry Data Security Standard)

Developed by the PCI Security Standards Council, which includes Visa, MasterCard, American Express, and Discover. This standard is mandatory for any organization that processes, stores, or transmits credit/debit card information.

PCI-DSS v4.0 (2022) has 12 core requirements:

1. Install and maintain network security controls (firewalls)
2. Apply secure configurations to all system components
3. Protect stored account data with encryption
4. Protect cardholder data with strong cryptography during transmission
5. Protect all systems against malware
6. Develop and maintain secure systems and software
7. Restrict access to cardholder data on a need-to-know basis
8. Identify users and authenticate access to system components
9. Restrict physical access to cardholder data
10. Log and monitor all access to system components and cardholder data
11. Test security systems and networks regularly
12. Support information security with organizational policies

5. CIS Controls (Center for Internet Security)

A prioritized set of 18 cybersecurity best practices (CIS Controls v8, published 2021). Designed to be practical and immediately actionable. Organized into 3 Implementation Groups based on organization size and resources.

Top Controls include: Inventory of Enterprise Assets, Inventory of Software Assets, Data Protection, Secure Configuration, Account Management, and Continuous Vulnerability Management.

Why it's popular: It tells you exactly what to do in priority order — start with the most impactful security controls first.

6. HIPAA (Health Insurance Portability and Accountability Act)

A US law that sets mandatory standards for protecting patient health information (PHI). Requires healthcare organizations to implement: Technical Safeguards (encryption, access controls), Administrative Safeguards (policies, training, audits), and Physical Safeguards (secure facilities, device controls).

7. IT Act 2000 & DPDP Act 2023 (India)

India's primary legal framework for cybersecurity and data protection. The IT Act 2000 defines cybercrimes and their penalties. The Digital Personal Data Protection Act 2023 (DPDPA) establishes the rights of individuals over their personal data and the obligations of organizations that collect it.

Comprehensive Comparison Table

Security Management: Key Concepts

Risk Management

The process of identifying, assessing, and prioritizing risks, then deciding how to handle each risk — either by reducing it (mitigate), accepting it, avoiding it, or transferring it (insurance).

Formula: Risk = Threat × Vulnerability × Impact

Security Policy

A formal document that defines an organization's rules and expectations for protecting its information assets. Three levels:

• EISP (Enterprise Information Security Policy): Highest level — covers the entire organization, all departments
• ISSP (Issue-Specific Security Policy): Covers a specific technology or topic (e.g., email use policy, ERP security policy)
• SysSP (System-Specific Security Policy): Technical rules for a specific system (e.g., firewall configuration rules)

Security Controls

Three categories of security controls — remember as PTT:

• Physical Controls: Locks, security guards, CCTV cameras, biometric door access
• Technical Controls: Firewalls, antivirus, encryption, IDS/IPS, multi-factor authentication
• Administrative Controls: Policies, user training, background checks, security audits