The History of Cybersecurity

By Victor Hoang · Updated Oct 24, 2026

In 1966, on the time-sharing system at the Massachusetts Institute of Technology, a routine mistake swapped two files. The file of user passwords traded places with the daily message. So every user who logged in saw everyone's password. Nobody had been attacked. The system had simply never been built to survive a mistake.

Cybersecurity did not begin with the Internet. Its oldest root is secret writing. Its modern form appeared in the 1960s, when shared computers first had to keep one user's files away from another. The turning point came on 2 November 1988, when a worm hit the Internet and a response team was created that same month. The throughline: every new way of sharing computing created a new way to break trust. Each breach produced a rule, a standard or an institution.

Most of the history below follows that pattern: a convenience arrives, a failure exposes the hidden assumption, and the field writes the rule that should have existed.

A quick definition. "Cybersecurity" here means protecting computers, networks and the data on them from unauthorized access, damage or disruption. Cryptography, the science of secret writing, is one tool inside it. For the network those tools protect, start with the pillar, The History of the Internet.

Timeline at a Glance

The Cipher Age (First century BCE-1945)

Security means hiding the message, not guarding the machine

The earliest form of the idea is secret writing. The Roman biographer Suetonius records that Julius Caesar wrote confidential letters in cipher, changing the order of the alphabet so no word could be read without the key. A reader had to "substitute the fourth letter of the alphabet, namely D, for A", and so on through the rest. That is a shift cipher, taught today as the Caesar cipher. It is a precursor, not cybersecurity: there was no computer to attack, only a messenger who might be caught.

The institution arrived much later. After the First World War, Britain kept its codebreakers together. The Government Code and Cypher School officially came into being on 1 November 1919 in Watergate House, led by Alastair Denniston, who was its first head from 1919 to 1942. It was formed from the Admiralty's Room 40 and the War Office's MI1(b), and it would later be renamed GCHQ.

Its record between the wars was uneven. GCHQ's own history says the school enjoyed "tremendous success" against foreign diplomatic codes but was much less successful against mechanical and electromechanical ciphers, most famously Enigma. When war came, the school moved to Bletchley Park, and with insights from the Poles and the French and new recruits such as Alan Turing it became what GCHQ calls an "industrialised intelligence agency". Codebreaking had turned from a craft into a production line. That mattered later: the people and ideas of wartime cryptanalysis fed directly into early computing, which is where the next problem came from. For the machines themselves, see the history of computers, and for a related story of a network growing out of a defense project, read the history of ARPANET.

For teams today: the first security question was "who can read this?" It is still the first question, and it still leaves out the second one, "who can get to the machine that holds it?"

The Shared Machine (1961-1972)

One computer, many users, and nobody to keep them apart

The turning point is time-sharing. Before it, a computer ran one job at a time and operators stood between users and the hardware. At MIT, development of the Compatible Time-Sharing System began in 1961, led by Fernando Corbató, Bob Daley and Marjorie Merwin-Daggett, and a version swapping four users to tape was demonstrated on an IBM 709 in November 1961, according to Multics historian Tom Van Vleck. Once several people share a machine, each needs private files. That requirement is the seed of the whole field.

Picture MIT's computation center on a Friday afternoon in 1966. A mistake by a Computation Center administrator swapped the password file with the message of the day, so each user who logged in was greeted with everyone's password in plain text. Bill Mathews of Project TIP noticed, entered the debugger and crashed the machine. Van Vleck notes that the episode came before, and was the origin of, the idea of one-way encrypting passwords. The lesson is blunt: a secret that the system stores in a readable form is only as safe as every administrator and every editor temp file around it.

The people paying for these machines noticed the same thing from the other direction. In October 1967 the Advanced Research Projects Agency organized a task force to study safeguards for classified information in multi-access, resource-sharing computer systems. Willis H. Ware of RAND is the report's author. The task force worked under the Defense Science Board, and RAND published its report in February 1970 for the Office of the Director of Defense Research and Engineering. Its sections ran from the nature of the threat to technical recommendations on hardware, software, access control, communication lines, terminals and certification.

The report was too sensitive to share. Because government representatives took part, RAND's foreword says, it was felt prudent to classify it Confidential, and DARPA declassified it on 10 October 1975. The reissue in 1979 was meant for civil agencies and industry, who had not had access. The result: the first serious thinking about computer security sat behind a classification stamp for more than five years.

Meanwhile, the network side showed its first oddity. In spring or summer 1971, Bob Thomas at BBN created Creeper, which copied itself across multiple TENEX computers and displayed "I'M THE CREEPER : CATCH ME IF YOU CAN". The Computer History Museum's timeline says Ray Tomlinson then wrote Reaper to track down Creepers and destroy them. Creeper ran on the early network described in the history of ARPANET, and it showed that a program could travel between machines on its own, and that a second program could be written to hunt it.

In October 1972, a study by James P. Anderson & Co. for the US Air Force's Electronic Systems Division took the next step. The Pentagon's later criteria describe it as the report that introduced the reference monitor concept: one mechanism that checks every access by every program against a list of what that user may do. The criteria say the concept was found to be an essential element of any system offering multilevel secure computing. That is the design idea behind every permission check that came afterward.

For teams today: passwords stored in readable form, a report nobody outside the Pentagon could read, and a self-copying program with no defense all point to the same gap. Decide who owns access control before the system is shared, not after.

The Rulebook Years (1976-1985)

Public-key math and the Pentagon's grading scheme

The turning point is a paper. In November 1976, Whitfield Diffie and Martin Hellman published "New directions in cryptography" in IEEE Transactions on Information Theory (volume IT-22, pages 644-654). Rivest, Shamir and Adleman later wrote that the Diffie-Hellman article motivated their research, because it "presented the concept but not any practical implementation". Until then, two parties who wanted to talk in secret had to share a key first, usually through a courier.

The RSA paper, received on 4 April 1977 and revised on 1 September 1977, removed that step. Its abstract describes a method in which publicly revealing an encryption key does not reveal the decryption key. Couriers or other secure means are no longer needed to transmit keys, and a message can be "signed" with a private key so anyone can verify it. The authors saw applications in "electronic mail" and "electronic funds transfer", which is exactly where the Internet later put them. The security of the scheme, they wrote, rests in part on the difficulty of factoring the published divisor. To follow how those messages then moved, read the history of email.

The second strand was institutional. The Pentagon wanted to buy computers it could trust, and needed a way to say what "trust" meant. Its first edition, CSC-STD-001-83, is dated 15 August 1983, and DoD 5200.28-STD, the Trusted Computer System Evaluation Criteria, followed on 26 December 1985. Readers know it as the Orange Book, after its cover. It was mandatory for DoD components carrying out technical security evaluation of automated data processing systems, and it graded systems in classes up to A1, "Verified Design". James Anderson is among the reviewers its authors thank, and its rationale section builds on his reference monitor.

The Orange Book made security measurable. It also had a limit that the next era exposed: it graded individual computers, and the real threat was moving onto networks where one machine was never alone.

For teams today: a shared vocabulary lets a buyer ask for "security" and get something specific. If your policy cannot be graded, it cannot be audited.

The Worm Shock (1988-1999)

A single program shows the whole Internet is one target

The turning point is a date. On 2 November 1988, a program attacked the Internet, then a collection of interconnected networks linking approximately 60,000 computers, according to the MIT team that took it apart. It broke into Berkeley UNIX and derivative systems and tried to break into other machines from each one it held. The Software Engineering Institute credits a graduate student, Robert Morris, with releasing the worm that brought the young Internet "to its knees".

The numbers that circulated afterward are worth reading carefully. The MIT team's own account says reporters were told about 60,000 Internet hosts and an estimated 10 percent infection rate at MIT. That rate was "a pure guess", and press reports later stated that at least 6,000 machines had been hit, a figure extrapolated from it. The team wrote that these numbers "were to stick in a way we never anticipated". A later Carnegie Mellon release describes the worm as having brought about 10 percent of Internet-connected systems to a halt, which is the same extrapolation carried forward. The honest summary is that the scale was large, and the exact count was never known.

The human lessons were as important as the technical ones. The MIT paper's conclusion notes that sites which disconnected at the first sign of trouble hurt themselves and the community, because they could not report findings or receive fixes. It also records that "the old boy network" worked: people called those they knew and trusted. And it asks the question every on-call engineer eventually faces: late at night, how do you know the person on the phone is who they say they are?

The institutional response was fast. In November 1988, the CERT Coordination Center was formed within Carnegie Mellon's Software Engineering Institute. DARPA created it, and its purpose was to "coordinate communication among experts during security emergencies". The SEI's own history says DARPA asked it "to establish a computer emergency response team". Incident response had become a permanent job, with a phone number.

Researchers had already warned that the foundation was weak. In 1989, Steven Bellovin of AT&T Bell Laboratories wrote that the TCP/IP protocol suite, developed under Defense Department sponsorship, contained serious flaws inherent in the protocols, including sequence number spoofing, routing attacks, source address spoofing and authentication attacks. Fixing one program would not fix that. For the protocols' origins, see the history of TCP/IP. The practical answer of the early 1990s was a wall. Bellovin and William Cheswick's "Network Firewalls" appeared in IEEE Communications Magazine in 1994, and the firewall became the default way to separate a trusted inside from an untrusted outside.

One more thing started in these years. In December 1989 a program known as the AIDS Trojan, or PC Cyborg, was released by Joseph Popp. An Oakland University survey of ransomware says it counted how many times a machine had booted, then hid directories and encrypted their names and displayed a message demanding payment for an expired software license. It was crude, but the business model of ransomware was already there.

For teams today: the worm's lasting lesson is that response speed depends on relationships and a current contact list. Write down who to call before you need to, and plan how you will verify them at 3 a.m.

The Ransomware Age (2000s-2021)

The perimeter holds, until one unpatched machine lets everyone in

The turning point is scale. The web, e-commerce and email put business on the Internet, as in the history of ecommerce and the history of the World Wide Web, and each connection was a way in. The 1989 idea of encrypting a victim's files for payment came back in far larger form.

The clearest public record of what that looks like inside an institution is the UK National Audit Office report on WannaCry. On Friday 12 May 2017 the ransomware was released worldwide, and it was the largest cyber attack to affect the NHS in England. The NAO found that the Department of Health had been warned about the risks a year earlier, and that NHS Digital issued critical alerts in March and April 2017 telling organizations to patch. But before 12 May the Department had no formal mechanism for checking whether local NHS organizations had complied. At least 81 of 236 trusts in England were affected, plus 603 primary care and other organizations, including 595 GP practices. NHS England identified 6,912 cancelled appointments and estimated that over 19,000 would have been cancelled in total. No NHS organization paid the ransom, and NHS Digital believed no patient data were compromised. The attack was slowed when a cyber researcher activated a "kill switch".

Four years later the target was infrastructure. The US Department of Energy records that Colonial Pipeline proactively shut down its pipeline system on 7 May 2021 in response to a ransomware attack and restarted it on 13 May. On 10 May the FBI said the DarkSide ransomware was responsible, and the joint CISA-FBI advisory the next day described DarkSide as a ransomware-as-a-service variant, meaning its developers lease the tool to others. A single compromise had stopped a physical supply chain.

WannaCry repeats a pattern from 1966: the fix existed, and the gap was ownership. Wi-Fi's security also moved in generations, as the history of Wi-Fi shows with WPA3 succeeding WPA2.

For teams today: patching is a management problem. The NHS had the alert and no way to confirm anyone had acted on it.

The Zero Trust Age (2014-present)

Trust moves from the network location to each request

The turning point is the vanishing perimeter. Google's engineers described the problem in a 2014 paper, "BeyondCorp: A New Approach to Enterprise Security" in ;login:. They argued that firewall-based perimeter security is fragile, because once an attacker breaks through, the attacker can often move freely through a privileged intranet. Mobile and cloud services made the perimeter harder to define at all, and the authors described removing the privileged intranet and putting corporate applications on the Internet. Software delivered over the Internet, the subject of the history of SaaS, is part of why: when the software lives outside your walls, the walls stop being the defense.

In August 2020 the idea became a standard. NIST published SP 800-207, Zero Trust Architecture, by Scott Rose, Oliver Borchert, Stu Mitchell and Sean Connelly. It describes zero trust as "an evolving set of cybersecurity paradigms" that move protection from fixed network boundaries to users, devices and resources. Neither network location nor ownership of an asset implies trust, and authentication and authorization happen before a session with a resource begins. In our reading, the reference monitor had returned at enterprise scale: every request is checked, every time.

The newest attack surface is the connections between systems. Software now acts through APIs, which is why API security has become a front-line concern, and the story of how those connections grew is told in the history of APIs. AI systems add a further layer: AI security covers attacks on the model, its training data and its prompts, not only on the software around them. The long arc runs from protecting a message, to protecting a machine, to protecting a network, to protecting every request.

For teams today: start from identity. Know who or what is asking, and check on every request, because the wall no longer marks the inside.

Key People

Key Facts

• The Government Code and Cypher School officially began on 1 November 1919.
• RAND's foreword says the Ware report was published in February 1970 and declassified on 10 October 1975.
• The MIT team that dissected the Morris worm said it hit an Internet of approximately 60,000 computers on 2 November 1988.
• The UK National Audit Office found at least 81 of 236 trusts in England were affected by WannaCry on 12 May 2017.
• Colonial Pipeline shut down on 7 May 2021 and restarted on 13 May.
• NIST published SP 800-207, Zero Trust Architecture, in August 2020.

The Pattern Behind the History

We call the sequence the Share, Break, Codify, Repeat Pattern. It is our synthesis of the history above, not a research finding.

1. Share. Time-sharing, networking and the cloud each opened a resource to more people.
2. Break. The 1966 password file, the 1988 worm and WannaCry each exposed a trust assumption nobody had written down.
3. Codify. The Ware report, the reference monitor, the Orange Book and NIST 800-207 turned the lesson into a rule.
4. Institutionalize. GC&CS and CERT/CC made the response a standing organization, not a favor between friends.
5. Repeat. The new rule fits the old layer, and the next way of sharing opens a new gap.

What It Teaches Teams Today

• Write the trust assumption down. The 1966 password file, the 1988 worm and the unpatched NHS machines all failed on something unstated.
• Name an owner for patching. The NHS received the alert and had no way to confirm action.
• Keep an incident contact list. The 1988 response worked because people knew whom to call.
• Check every request. Zero trust is the reference monitor idea applied to users, devices and resources, not just to one computer.
• Do not trust a single number. The "6,000 machines" figure was extrapolated from a guess and repeated as fact.

Cybersecurity is the history of trust being extended, abused and rewritten as a rule. To see the network it protects, read the Internet timeline.