Defensive Cyber Operations

An experimental program that spread far faster than its creator intended slowed thousands of connected computers to a halt, leading directly to the founding of CERT/CC at Carnegie Mellon University as a permanent coordination point for reporting and responding to future incidents.

As computer networks spread beyond research and military institutions into wider commercial use, Australia, Japan and other countries built their own coordination centres modelled on the earlier American example, beginning the network of national response teams that later underpinned international incident cooperation.

Billions were spent auditing and rewriting software across banking, aviation, utilities and government systems to prevent date-related failures, establishing much of the practice of systematic infrastructure risk assessment that later cyber defence regulation built upon.

Often called the Great Firewall, the system gave China a defensive architecture unlike any other country's, combining content control with monitoring capacity at the scale of the entire national network rather than at individual organisations, a model since studied and partly copied elsewhere.

The attacks followed a diplomatic dispute with Russia over the relocation of a Soviet war memorial and were widely described as the first sustained cyber campaign against an entire country's civilian infrastructure, prompting Estonia and NATO to treat national network defence as a strategic priority.

Set up in Estonia a year after the country's own cyberattacks, the centre became the alliance's hub for cyber defence research, training and the legal analysis later published as the Tallinn Manual on how existing international law applies to cyber conflict.

Finding that malware could cross from office networks into the specialised control systems running physical equipment such as centrifuges pushed operators of power plants, water systems and factories to treat previously isolated industrial equipment as a genuine target requiring its own defences.

Housing the new centre within the signals intelligence agency GCHQ but giving it a public mission to help government, business and the public defend their own networks became a model several other countries later adapted for their own national cyber agencies.

Disguised as ransomware but designed only to destroy data, the malware crippled shipping giant Maersk, the pharmaceutical firm Merck and numerous other multinational companies within hours, becoming a defining example of third-party software supply-chain risk to corporate network defenders.

Unpatched Windows systems let the worm self-propagate across networks worldwide within hours, cancelling operations and appointments across dozens of NHS trusts, until a security researcher's discovery of an unregistered domain acting as a kill switch slowed its spread.

In the first half of 2017, two billion data records were stolen or affected by cyberattacks, while ransomware payments reached US$2 billion, twice the 2016 figure. The scale of losses marked a step change in the threat that defensive cyber operations were expected to counter, and helped drive investment in detection and response capability.

As of 2019 there were no commercially available, widely used active defence systems that protect systems by deliberately increasing their complexity or variability to make attack harder. This marked a persistent gap in defensive capability, leaving practitioners reliant on conventional monitoring, patching and perimeter defences.

Water utilities, industrial control systems and government websites faced repeated intrusion attempts and defacement claims during and after the fighting, most of which caused limited disruption, though officials said the volume and persistence of attempted attacks reached unusually high levels.

Businesses above a revenue threshold that made a ransomware payment became required to report it to the government under the new Cyber Security Act, intended to give authorities a clearer national picture of ransomware's true scale rather than relying on voluntary disclosure.

Repeated disruption to municipal and federal services pushed budget allocations for detection, response and workforce training higher, part of a broader Latin American pattern of governments treating ransomware resilience as a standing rather than occasional cost.

The cuts, part of a wider reduction in federal cybersecurity spending, drew warnings from former officials and industry groups that state and local governments and smaller critical infrastructure operators would lose a key source of free technical support and threat warnings.

Government-backed audits and mandatory security upgrades were extended to contractors handling sensitive naval and weapons data, responding to a pattern of espionage that had repeatedly reached design information despite existing protections.

Beijing continued a practice, begun in earnest a few years earlier, of publicising detailed technical claims about alleged American hacking of Chinese universities and infrastructure, mirroring the kind of public attribution Western governments had long applied to Chinese state-linked activity.

Following the finalisation of new international post-quantum standards, banks and other operators of essential systems were told to begin planning a transition away from encryption methods a sufficiently powerful future quantum computer could eventually break.

The directive extended baseline security and incident-reporting obligations to a much wider range of sectors and firms than its predecessor, and most member states had not finished national transposition by the deadline, leaving the bloc's actual level of protection uneven for months afterward.

Amendments gave the Cyber Security Agency oversight of systems that critical services increasingly depended on even when not owned by the critical infrastructure operator itself, closing a gap regulators said had grown as more essential functions moved to third-party cloud providers.

The planned centre was intended to bring military, civilian and industry cyber expertise together in one location to speed detection and shared response to attacks on allied networks, building on years of more ad hoc information sharing between national cyber commands.

In 2021 UN member states opened negotiations on a draft treaty covering cybercrime. Such an instrument bears directly on defensive cyber operations by shaping the legal basis for attribution, cross-border investigation and prosecution of attackers, who are otherwise rarely brought to account.

The global shift to remote working during the COVID-19 pandemic sharply expanded organisations' attack surface, and cybersecurity statistics for 2020 recorded a large increase in hacked and breached data. Defensive operations had to extend monitoring and protection beyond controlled corporate networks to dispersed home environments.