Computer security

• 1. Introduction

  ›

  Computer security sits at the center of nearly every decision made by governments, hospitals, banks, and ordinary people with a smartphone. On the 2nd of November 1988, a 23-year-old Cornell University graduate student named Robert Tappan Morris released a program onto a network of roughly 60,000 machines. He said he only wanted to count how many computers were connected to the Internet. What he got instead was the first internet computer worm, a self-replicating piece of code that ground mainframes and workstations to a halt. That single event posed questions that societies are still wrestling with: Who is responsible when a system fails? How do you catch an attacker who hides behind proxy servers in a dozen countries? And what does it actually mean to keep a computer secure? The answers, it turns out, involve everything from metal door locks and USB dongles to international law, corporate culture, and the way ordinary employees think about their own passwords.

• 2. How Attackers Get In

  ›

  In April 2023, the United Kingdom Department for Science, Innovation and Technology surveyed more than four thousand organizations across business, charity, and education. The results were stark: 32% of businesses and 24% of charities recalled a breach or attack in the previous year. For large businesses the figure climbed to 69%. Those numbers capture only what organizations could remember and were willing to report. The actual landscape is far wider.

  Attackers use a taxonomy of methods that ranges from brute-force blunt instruments to surgical social manipulation. A backdoor is any hidden method of bypassing authentication, sometimes placed by the original designers and sometimes installed later by criminals through malware. Once a backdoor is open, cybercriminals can modify files, steal personal information, install unwanted software, and even take control of the entire computer. Backdoors are especially hard to find because they often live inside source code or firmware, invisible without intimate knowledge of the operating system.

  Denial-of-service attacks take a completely different approach: rather than sneaking in, the attacker simply drowns a target in traffic until legitimate users cannot reach it. Distributed versions, called DDoS attacks, draw on botnets, networks of compromised machines that can generate traffic far beyond what any single attacker could produce. A variant called distributed reflective denial-of-service fools innocent systems into sending traffic toward the victim, letting attackers amplify their effect while using very little bandwidth themselves.

  Phishing occupies a category of its own. By sending a convincing fake email, text, or phone call, attackers trick users into handing over usernames, passwords, and credit card details without ever touching the target machine's defenses. A more focused variant, spear-phishing, uses personal or organization-specific details to make the attacker appear like a trusted source. In early 2016, the FBI reported that business email compromise scams, in which attackers impersonate executives to trick finance staff, had cost US businesses more than $2 billion in approximately two years. In May 2016, the Milwaukee Bucks NBA team fell victim to exactly this kind of attack when someone impersonating team president Peter Feigin convinced staff to hand over all employees' 2015 W-2 tax forms.

• 3. The Malware Menagerie

  ›

  Malicious software, or malware, is defined as any code intentionally written to harm a computer system or its users. Under that umbrella lives a wide and evolving population of threat types, each with a distinct mode of attack.

  Viruses are malicious code that hijacks software with the intention to do damage and spread copies of itself to other programs on a computer, but they depend on a human opening an infected file to activate. Worms have no such dependency. They are self-replicating and spread between programs, apps, and devices without any human interaction. The 2010 Stuxnet worm illustrated just how targeted a worm could become: it reportedly destroyed almost one-fifth of Iran's nuclear centrifuges by disrupting the industrial programmable logic controllers inside the facility, and it is generally believed to have been launched by Israel and the United States.

  Trojan horses disguise themselves as legitimate or helpful software to trick users into installing them. Once inside, a Remote Access Trojan can create a secret backdoor on the affected device. Spyware gathers information silently and transmits it back to attackers; keyloggers, the most common form, record every keystroke to harvest usernames, passwords, and banking credentials.

  Scareware weaponizes anxiety rather than code. A sudden pop-up with an urgent message, usually warning that the user has broken the law or that their device has a virus, pressures victims into buying or installing software they do not need. Ransomware goes further: it encrypts a victim's files and demands payment, usually in Bitcoin, to restore access. The June 2021 Colonial Pipeline attack brought ransomware into sharp public view when it took down the largest fuel pipeline in the United States and caused shortages across the East Coast.

  Surfacing in 2017, multi-vector polymorphic attacks added another dimension of difficulty. These threats combine multiple attack channels simultaneously, spreading via the web, email, and applications, and they constantly change form, making it nearly impossible to detect them using signature-based defenses.

• 4. The Human Factor

  ›

  The Verizon Data Breach Investigations Report 2020, which examined 3,950 security breaches, found that 30% of cybersecurity incidents involved internal actors within a company. That figure points to a truth that many security engineers spend careers trying to engineer around: the end-user is widely recognized as the weakest link in the security chain, and it is estimated that more than 90% of security incidents and breaches involve some kind of human error.

  Common mistakes include poor password management, sending sensitive data to the wrong email recipient, and an inability to recognize fake websites. A particularly telling habit is saving login credentials directly in a browser to ease access to banking sites, a convenience that becomes a gift to any attacker who gains physical or remote access to the machine.

  Social engineering formalizes the art of exploiting human trust. Rather than attacking software, the attacker manipulates a person into disclosing passwords or granting physical access by impersonating a senior executive, a bank, a contractor, or a customer. The technique exploits cognitive biases as reliably as buffer overflows exploit code.

  One countermeasure with a suggestive name is inoculation, derived from inoculation theory in psychology. The approach attempts to build resistance to manipulation by exposing people to weaker versions of persuasion attempts before the real attack arrives. Even in highly disciplined environments such as military organizations, social engineering attacks can still be difficult to foresee and prevent, which is why researchers argue that security awareness training at all levels reduces cyber risk for both individuals and organizations.

  The concept of digital hygiene, a term perhaps coined as late as 2000 by Internet pioneer Vint Cerf, frames routine protective behaviors the way personal hygiene frames physical health. It has since been adopted by the United States Congress and Senate, the FBI, and EU institutions. The most common acts of digital hygiene include updating malware protection, maintaining cloud backups, managing passwords carefully, and keeping network firewalls in place.

• 5. Defending the Architecture

  ›

  Security by design treats protection not as a feature added after the fact but as a core requirement from the first line of code. The UK government's National Cyber Security Centre distills this philosophy into five principles: understand the system before building it, make attacking the data inherently difficult, protect core services so they are essentially never down, detect attacks as quickly as possible, and design so that any successful attack causes minimal harm.

  At the technical level, several specific tools embody these principles. The principle of least privilege holds that each part of a system should have only the access it needs for its function, so a compromised component exposes only a narrow slice of the whole. Defense in depth requires that more than one subsystem be violated before an attacker can compromise overall integrity. Audit trails, especially when stored remotely in an append-only format, make it harder for intruders to erase evidence of their actions.

  Firewalls remain the most common network-level prevention tool. They can be hardware or software, and in most UNIX-based operating systems such as Linux, firewall capabilities are built directly into the kernel, providing real-time filtering and blocking. Intrusion Detection Systems watch for network attacks in progress and assist with forensics after an incident. Some organizations are turning to big data platforms such as Apache Hadoop to extend machine learning into detection of advanced persistent threats.

  Hardware-based protection adds a physical dimension that software alone cannot replicate. Trusted Platform Modules integrate cryptographic capabilities directly into a device via a microprocessor, authenticating hardware at the network level. Computer case intrusion detection uses a simple push-button switch to alert an operator if a machine's case has been opened since the last boot. The magazine Network World has identified infected USB dongles connected from inside a firewall as the most common hardware threat facing computer networks, which is why disabling unused USB ports is now a standard hardening step.

  Role-based access control, used by the majority of enterprises with more than 500 employees, restricts system access to authorized users by assigning permissions to roles rather than individuals. Formal verification goes further still: operating systems such as seL4 and SYSGO's PikeOS have been mathematically certified for correctness, though they make up a very small percentage of the market.

• 6. High-Value Targets

  ›

  Financial systems attract attackers for the most direct of reasons: money. Institutions like the US Securities and Exchange Commission, SWIFT, and commercial banks are prominent targets for criminals interested in manipulating markets. A UCLA Internet Report from 2000 found that more than nine out of ten internet users were somewhat or very concerned about credit card security. In response, Visa and MasterCard cooperated to develop the secure EMV chip now embedded in credit cards, and banks began issuing hand-held card readers for online transactions through the Chip Authentication Program.

  Critical infrastructure poses a different order of risk. Stuxnet demonstrated that equipment controlled by computers not connected to the Internet can still be vulnerable, in that case through physical access to the facility. In 2014, the Computer Emergency Readiness Team, a division of the Department of Homeland Security, investigated 79 hacking incidents at energy companies alone. A successful attack on a distributed energy grid could cause loss of power across a large area for a prolonged period, consequences comparable to a natural disaster.

  Aviation systems carry their own exposure. Radar surveillance over oceans extends only 175 to 225 miles offshore, and a simple power outage at one airport can cause repercussions worldwide. Adding physical security devices to aircraft could increase unloaded weight and reduce cargo or passenger capacity, a constraint that makes security trade-offs in aerospace unusually acute.

  Government data has suffered some of the most consequential breaches on record. In April 2015, the Office of Personnel Management discovered it had been penetrated more than a year earlier. The stolen records totaled approximately 21.5 million personnel files, including Social Security numbers, dates and places of birth, addresses, and fingerprints of current and former government employees and anyone who had undergone a government background check. Federal officials described it as among the largest breaches of government data in US history, and it is believed the hack was perpetrated by Chinese hackers.

  Medical devices have introduced a category of threat that did not exist a generation ago. Pacemakers and insulin pumps have had potentially deadly vulnerabilities demonstrated, and hospitals have been hit with ransomware, Windows XP exploits, and data breaches. On the 28th of December 2016, the US Food and Drug Administration released recommendations for how medical device manufacturers should maintain the security of Internet-connected devices, but without any enforcement structure attached.

• 7. Law, Attribution, and Cost

  ›

  Estimating the financial damage from security breaches is genuinely difficult because no standard model exists and organizations are not required to report losses. Consulting firm estimates for a single year in the early 2000s ranged from $13 billion for worm and virus damage alone to $226 billion when accounting for all forms of covert attack, and those figures were widely disputed as anecdotal. The Gordon-Loeb Model, an analytical framework for security investment, suggests that the amount a firm should spend protecting information is generally only a small fraction of the expected loss from a breach.

  Attribution compounds every legal challenge. Attackers route traffic through proxies, temporary dial-up accounts, wireless connections, and anonymizing procedures across multiple jurisdictions. Successfully tracing an attack often requires collecting logs from many countries simultaneously, a process that can take years and may still dead-end when local laws provide no mechanism for prosecution. The result, as one observer put it, is that the Internet is as if someone had given free plane tickets to all the online criminals of the world.

  Attacker motivations span a wide spectrum. Some are thrill-seekers or vandals. Hacktivists target organizations whose activities they oppose: security firm HBGary Federal suffered a serious series of attacks in 2011 from the hacktivist group Anonymous after the firm's CEO claimed to have infiltrated them. State-sponsored attackers are now well-resourced and common, though the field began with amateurs such as Markus Hess, who hacked for the KGB, a story later recounted by Clifford Stoll in The Cuckoo's Egg. The 2015 Ukraine power grid hack, which reportedly used spear-phishing, file destruction, and denial-of-service attacks in combination, illustrated how state-level actors can coordinate multiple attack types against critical infrastructure.

  In a widely publicized 2015 test, hackers remotely took control of a vehicle from 10 miles away and drove it into a ditch, prompting Tesla in 2016 to push security fixes directly over the air into its cars' computer systems. In September 2016, the United States Department of Transportation announced initial safety standards for autonomous vehicles and called on states to develop uniform policies, a regulatory footprint still taking shape as connected cars carry sensors, WiFi, Bluetooth, and cell phone network access into every lane of traffic.