Security
How the field of a Cybersecurity Analyst got here: the sourced milestones from every published course of this career, on one axis.
1979 to 2025
252 milestones across 26 courses
The axis stretches toward recent years, where most milestones fall. Bars count milestones per year; dots are single milestones.
15 milestones
1979
NIST publishes FIPS 65 as one of the earliest federal pieces of guidance for analyzing risk to information technology systems, establishing that security decisions should rest on a structured estimate of exposure rather than on intuition.
1980 Apr
James P. Anderson's report described using audit information to distinguish normal use from suspected misuse. It established audit review as a basis for automated intrusion detection research.
1982 Aug
SMTP standardized interoperable mail transfer and relay. Its store-and-forward design created the cross-domain trust boundary that later email-security controls protect.
1983
Cohen's controlled experiments and later publication formalized computer viruses as a subject for technical study rather than only an operational incident.
1984
The foundational patent for challenge-response authentication using public-key cryptography, which later underpinned hardware token systems for decades.
1985 Aug
Dorothy Denning and Peter Neumann documented requirements for a real-time Intrusion-Detection Expert System. The work connected statistical profiles and expert-system rules to system audit records.
1986
The first widely deployed hardware OTP token, generating codes from a time-synchronized algorithm. SecurID became the enterprise standard for second-factor authentication for over two decades.
1987 Feb
The model described detecting security violations through abnormal patterns in audit records. It gave the field a general framework independent of a particular system or vulnerability.
1988
The Morris worm exploited a sendmail buffer overflow and spread across thousands of hosts in hours. The cleanup effort showed how unprepared operators were to deploy fixes quickly, making fast, coordinated fix distribution an operational necessity.
1988 Nov
The CERT Coordination Center was established after the Morris worm. It created a coordinated incident-response function that depended on collecting and communicating technical evidence.
1988 Nov
The Morris Worm disrupted the early Internet on November 2, 1988. DARPA asked the Software Engineering Institute to establish the coordination center that became CERT/CC so incident analysis and communication could be coordinated.
1988 Nov
After the Internet worm disrupted connected systems, DARPA asked the Software Engineering Institute to establish a coordination point for computer-security incidents. Incident response gained a dedicated function for sharing analysis and mitigation information.
1988 Nov 2
The Morris Worm disrupted the early Internet. DARPA asked the Software Engineering Institute to establish the CERT Coordination Center to coordinate vulnerability reporting and incident response.
1988 Nov 25
ITU approved X.500 as an overview of directory concepts, models, and services. Directory standards gave distributed identity records a common information and service model.
1989
The first ransomware attack used infected diskettes and a ransom demand after repeated system reboots. It established the extortion pattern before modern internet-scale delivery.
25 milestones
1990
The Forum of Incident Response and Security Teams formed after separate response teams encountered coordination problems across constituencies, languages, and time zones. Security response gained a continuing international coordination forum.
1990
The Forum of Incident Response and Security Teams formed after isolated responses produced duplicated effort and conflicting solutions. It made cross-team communication and cooperation a durable part of the practice.
1991
EICAR created a vendor-neutral forum for anti-malware research and later distributed a non-malicious test file for safely checking antivirus response.
1991 Jun 13
Digital Equipment Corporation delivered the SEAL firewall, combining a packet-filtering gateway with application proxy and mail components. It became an early commercial firewall architecture.
1991 Nov
NIST documented how to establish a computer security incident response capability. The guide framed centralized, skilled response as a way to react quickly and prevent recurring problems.
1992 Apr
The AICPA issued Statement on Auditing Standards No. 70 for reporting on controls at service organizations, which became the dominant US mechanism for those examinations for nearly two decades.
1992 Oct
Ferraiolo and Kuhn presented a formal role-based access control model in which access is mediated through roles. The model generalized earlier application-specific role controls.
1993 Jul
The IETF published a lightweight client-server protocol for accessing X.500 directories. It reduced dependence on heavier directory access mechanisms.
1994 Dec
NIST documented firewall components, access policies, and implementation choices to help organizations plan and purchase Internet firewalls.
1995
Vern Paxson designed and implemented the initial Bro network monitor. Its event-oriented analysis later continued under the Zeek name.
1995 Feb
The British Standards Institution published BS 7799-1, a code of practice for information security management. It gave practitioners a shared vocabulary for security controls, which later fed the international standard.
1995 Oct
The handbook introduced information security fundamentals, including the concept of controls and the management, operational, and technical classes. It gave practitioners a durable vocabulary for connecting safeguards to protection objectives.
1995 Oct 24
The EU adopted Directive 95/46/EC, establishing the earlier data-protection framework that the GDPR later replaced.
1997 Sep
The Site Security Handbook described filtering, proxy services, and firewall architecture as parts of Internet-connected site security.
1998
MIT Lincoln Laboratory published the 1998 DARPA Intrusion Detection Evaluation dataset and evaluation material. The effort made comparative evaluation of intrusion-detection approaches a public research concern.
1998
Martin Roesch released the software that became Snort as an open network sniffer. The project provided a foundation for widely deployable rule-driven inspection.
1998 Mar
S/MIME described cryptographic message content protection for MIME mail. It established a message-level alternative to protecting only the transport connection.
1998 Nov
RFC 2401 defined a security architecture for IP traffic using authentication, encapsulation, and security associations. It gave site-to-site and host-to-host protection a common standards-track foundation.
1999
MITRE launched the Common Vulnerabilities and Exposures List. Shared identifiers made it possible to correlate vendor, tool, and advisory references to the same public weakness.
1999
Intrusion detection capability changed Snort from a sniffer into a network IDS. Practitioners could express and share traffic signatures in an open engine.
1999
MITRE launched the Common Vulnerabilities and Exposures project so each publicly known vulnerability received one canonical identifier. The numbering scheme became the identity layer that CNAs, advisories, and the KEV catalog build on.
1999
The UK NISCC established TLP to express how far sensitive security information may be shared. It gave operational communities a compact handling vocabulary for exchange.
1999 Jul
CERT reporting described widespread deployment of networks using tools such as trinoo and Tribe Flood Network. Defenders had to treat coordinated traffic sources and compromised intermediaries as an operational problem.
1999 Aug
RFC 2647 defined common terms for packet filtering, stateful filtering, proxies, rulesets, and protected networks so implementations could be discussed and benchmarked consistently.
1999 Sep
The CVE Program launched its public list with a common set of identifiers for known vulnerabilities. Security teams and products gained a shared reference for exchanging vulnerability information.
55 milestones
2000
NIST changed ICAT from an attack catalog into the ICAT Metabase for vulnerabilities. It linked vulnerability information with public advisories, bulletins, and patch sites.
2000 Feb
Public attacks against major e-commerce sites demonstrated that distributed flooding could disrupt prominent Internet services. The event accelerated attention to coordinated detection and response.
2000 Oct
The RFC documented interoperability requirements and showed how filtering could disrupt Path MTU Discovery and application protocol negotiation.
2000 Dec
The first international edition of the code of practice, ISO/IEC 17799:2000, made the BS 7799 approach available globally. It established the control-catalog tradition that became Annex A.
2001
Vontu launched in San Francisco to detect and block disclosure of sensitive data by policy. Its product was later described as the first to combine endpoint and network coverage for data at rest, in motion, and in use, the three-state framing DLP still uses.
2001 Aug
RFC 3164 documented the widely implemented BSD syslog message and relay model. It gave centralized collectors a shared reference while also recording delivery and security limitations.
2001 Aug
RFC 3164 documented the observed BSD syslog protocol and its device, relay, and collector roles. It provided a common reference for moving log messages between systems.
2001 Nov
NIST published an enterprise primer on selecting, configuring, managing, and integrating intrusion detection systems. It formalized IDS as part of organizational security infrastructure.
2001 Dec 1
OpenBSD introduced PF as its packet filter with network address translation. The project later documented filtering, tables, logging, traffic control, and redundancy around the same system.
2002 Jan
NIST issued dedicated guidance on firewall technologies and policy, turning deployment and management into a documented security lifecycle.
2002 Jul
NIST publishes the original SP 800-30, the Risk Management Guide for Information Technology Systems, giving assessors a methodology for identifying threats and vulnerabilities and rating risk on a qualitative scale.
2002 Oct
DDoS attacks against root name servers reinforced that service availability depends on name resolution as well as an application's own hosts. DNS capacity and distribution became explicit resilience concerns.
2002 Nov
NIST SP 800-48 set out security recommendations for wireless networks as WLAN use expanded. It established that radio networks needed dedicated configuration, access-control, and monitoring treatment.
2002 Nov 1
OASIS approved an XML framework for authentication, attribute, and authorization assertions. It established an interoperable foundation for browser single sign-on across security domains.
2002 Dec
The Federal Information Security Management Act required federal agencies to develop, document, and implement information security programs. That obligation created the legal driver for standardized security controls across the federal government.
2002 Dec
The E-Government Act of 2002 enacts FISMA, requiring federal agencies to conduct risk assessments and authorize systems before operation, turning the SP 800-30 methodology into a statutory practice.
2003
Microsoft moved to a monthly security update cycle published on the second Tuesday of each month. The regular rhythm gave enterprises a planning beat, while out-of-band releases became the mechanism for fixes that could not wait.
2004
NIST publishes the original SP 800-37, formalizing the certification and accreditation process in which a senior official reviews assessed risk and explicitly authorizes a system to operate.
2004
RSA hardware token install base demonstrates the market for something-you-have authentication, though cost and logistics keep it confined to regulated and enterprise environments.
2004
Inline capability allowed Snort to stop malicious traffic instead of only reporting it. The operational concern expanded from detection accuracy to traffic-path availability and false-block impact.
2004
Microsoft released Windows Firewall as a component of Windows XP Service Pack 2, moving host-based filtering into a widely deployed operating system baseline.
2004 Jan
The Computer Security Incident Handling Guide defined basic incident response terminology and concepts for organizational capabilities.
2004 Feb 11
The NIST RBAC model became an American National Standard. This gave role, permission, hierarchy, and constraint concepts a common standard form.
2004 Jun 1
VirusTotal made aggregated scanner results and shared sample context available through an online service, changing reputation lookup and collaborative triage.
2005
MITRE began the work that led to CWE under the NIST SAMATE project. The taxonomy connected individual vulnerability records to recurring classes of software weakness.
2005
NIST replaced ICAT with the National Vulnerability Database. Vulnerability-management programs gained a national source for enriched vulnerability data and search.
2005
Windows Server Update Services gave organizations control over distributing Microsoft updates across thousands of machines, with approval, targeting, and reporting replacing per-machine update checks.
2005 Feb
NIST published a catalog for selecting and specifying security controls for federal information systems. It established a repeatable control selection approach that accounts for system categorization.
2005 Mar
OASIS approved SAML 2.0 and unified federation building blocks from SAML, Shibboleth, and the Liberty Alliance. Its assertions, bindings, profiles, and metadata remain a common enterprise SSO integration boundary.
2005 Jun
A revised edition updated the code of practice, tightening the control set and its presentation. It remained the reference for implementing information security management controls.
2005 Oct
ISO and IEC published ISO/IEC 27001:2005 for information security management systems. The standard tied risk-based management to the selection of proportionate controls for information assets.
2005 Oct
ISO/IEC 27001:2005 became the requirements standard for a certifiable information security management system, paired with the 17799 code of practice for control implementation.
2005 Dec
The HMAC-Based One-Time Password algorithm standardizes event-driven OTP generation, giving the industry an open alternative to proprietary token systems and enabling interoperable hardware and software authenticators.
2006
MITRE released the first Common Weakness Enumeration List. Practitioners gained a structured vocabulary for grouping recurring weakness patterns behind individual findings.
2006
PCI DSS v1.1 became the baseline referenced by the later SAQ revision history. The standard began a documented cadence of aligned validation tools and requirements.
2006 Mar
FIPS 200 established minimum security requirements for federal information and information systems, organized across seventeen security-related areas. It defined the management, operational, and technical control classes.
2006 Apr
SPF documented DNS-published authorization of SMTP senders. It made the envelope sender identity an operational authorization target.
2006 Sep
NIST SP 800-92 described log-management infrastructure, planning, and operational processes across an enterprise. Logging became an explicit program that supported analysis and incident handling rather than a collection of isolated files.
2006 Sep
NIST published its guide to computer security log management. The guide covered building and maintaining enterprise log-management infrastructure and processes.
2006 Dec
Revision 1 of the security controls catalog organized controls into families and established the baseline model tied to FIPS 199 impact levels. It turned statutory requirements into a specific, assessable control set.
2007 Feb
NIST replaced its IDS guide with guidance covering detection and prevention. It organized enterprise technology into network-based, wireless, network behavior analysis, and host-based classes.
2007 May
DKIM standardized domain-associated message signatures. Receivers could validate a signing domain independently of the SMTP path.
2007 Aug
RFC 4987 collected mitigations for exhaustion of TCP half-open connection state, including filtering, SYN cookies, proxies, and hybrid approaches. It made delayed state allocation a documented defense principle.
2007 Aug
ISO/IEC 17799:2005 and its Corrigendum changed the reference number to ISO/IEC 27002:2005, aligning the code of practice's numbering with the 27000 family that 27001 had started.
2007 Aug
The open framework made repeatable extraction of processes, mappings, and other artifacts from volatile memory available to investigators and malware analysts.
2007 Nov
Symantec announced the purchase of Vontu for 350 million dollars and completed it at the end of the month. The deal moved DLP from a niche category into the portfolios of mainstream enterprise security vendors.
2007 Dec
RFC 4732 described denial-of-service threats across protocols, hosts, and networks and the tradeoffs of mitigations. It established a cross-layer view rather than a single-appliance model.
2008 Mar
Revision 1 updated the incident-handling guide. Its later supersession records the revision as part of the sequence that shaped the familiar preparation-through-lessons-learned model.
2008 May
The Time-Based One-Time Password standard builds on HOTP with a time source, enabling the authenticator apps and software tokens that make MFA accessible beyond organizations that can issue hardware.
2008 Jul
The assessment guide defined examine, interview, and test procedures for determining whether controls are implemented correctly, operating as intended, and producing the desired outcome. It made control assessment a repeatable discipline.
2008 Aug
McAfee closed its 46 million dollar acquisition of Reconnex, a network DLP and data-at-rest discovery vendor, and folded the technology into ePolicy Orchestrator. Consolidation ran in parallel, with EMC buying Tablus and Websense buying PortAuthority.
2008 Oct
Version 1.2 aligned the SAQ with revised requirements and testing procedures. This made version changes operational for entities using reporting tools.
2009 Mar
RFC 5424 specified a standards-track syslog protocol with a message format, timestamps, structured data, and transport mappings. Those details support consistent collection and interpretation.
2009 Sep
NIST SP 800-41 Rev. 1 updated its firewall guidance with policy, selection, configuration, testing, deployment, and management considerations. Firewall operation became a lifecycle concern rather than only a perimeter-device purchase.
2009 Sep 28
The revision expanded guidance across network and host-based firewall technologies, placement, policy, testing, deployment, and management.
105 milestones
2010
Cuckoo established an open architecture for launching samples in isolated guests and collecting process, file, memory, screenshot, and network evidence.
2010
NIST revises SP 800-37 into the Risk Management Framework, replacing certification and accreditation with a life-cycle process of categorize, select, implement, assess, authorize, and monitor.
2010 Mar
The Open Information Security Foundation launched alongside the first Suricata release. Practitioners gained another open engine designed for network detection, prevention, and monitoring.
2010 Apr
The AICPA moved service-organization reporting from an auditing standard (SAS 70) to an attestation standard (SSAE 16), aligning more closely with international assurance practice.
2010 May
NIST updated federal contingency planning guidance with risk management and system development life cycle considerations. This reinforced that recovery requires planning for systems and operations, not only backups.
2010 Jul
The root-zone deployment made cryptographic trust anchors available from the top of the DNS hierarchy. It made authenticated DNS responses a practical part of the internet's security architecture.
2010 Oct
Version 2.0 updated requirements and testing procedures. The associated SAQ history records the alignment of assessment documentation with that revision.
2010 Nov 4
The Commission presented its comprehensive approach to personal-data protection, beginning the policy path toward a new regulation.
2011
Lockheed Martin published an intelligence-driven defense model that linked intrusion phases, indicators, defensive actions, and campaign analysis in an iterative feedback loop.
2011
The paper presented intrusion analysis as a sequence of adversary actions and defense opportunities. It gave defenders a behavior-oriented way to organize investigation before the modern hunting vocabulary was common.
2011
NIST SP 800-40 Revision 3 described enterprise patch management as preventive maintenance. The guidance emphasized identification, prioritization, acquisition, testing, deployment, and verification.
2011
NIST publishes SP 800-39, Managing Information Security Risk, framing risk management as an ongoing process at the organization, mission/business-process, and information-system tiers.
2011 Feb 5
The public beta made the automated sandbox available for local deployment and integration into broader analysis systems.
2011 May
The project later named MISP began as an attempt to replace IOC exchange through email and PDF files with machine-processable sharing.
2011 Jun 15
SSAE 16 became required for service organization reports with periods ending on or after June 15, 2011, ending SAS 70 as the governing standard for new reporting periods.
2011 Sep
NIST SP 800-137 defined an organization-wide strategy for ongoing visibility into assets, threats, vulnerabilities, and control effectiveness. Monitoring outputs were tied directly to risk decisions and risk tolerance.
2012
NIST publishes SP 800-30 Revision 1, recasting the assessment as prepare, conduct, and maintain, and grounding risk as a function of threat-event likelihood and impact.
2012 Jan
MITRE published STIX as an effort to represent cyber threat information in an expressive, extensible, and automatable language.
2012 Jan 25
The Commission proposed comprehensive reform of the 1995 rules, including stronger online privacy rights.
2012 Feb
NIST SP 800-153 consolidated recommendations for securing wireless clients, access points, switches, and monitoring throughout the WLAN lifecycle. Wireless security became an operational design and monitoring concern, not only a passphrase choice.
2012 Aug
Revision 2 addressed organizing an incident response capability and handling incidents from preparation through post-incident lessons learned. It became the widely used reference for the lifecycle model.
2012 Aug
NIST revised its Computer Security Incident Handling Guide to address evolving threats and incident response competencies. The guide linked preparation, detection, analysis, containment, recovery, and lessons learned into incident handling practice.
2012 Oct
The IETF standardized an authorization framework for clients to obtain limited access to HTTP services. Its roles and flows later became the base for OpenID Connect authentication.
2012 Nov
MITRE published TAXII specifications for services and message exchanges that transport structured cyber threat information between producers and consumers.
2013
Microsoft added DLP policy templates, transport-rule conditions, and policy tips to Exchange Server 2013. Content inspection for email moved into the mail server itself rather than a separate appliance or gateway.
2013
MITRE began ATT&CK to document adversary tactics, techniques, and procedures for research on endpoint telemetry and post-compromise analytics. Security operations teams gained a shared behavior model for detection and assessment.
2013
Revision 3 of the guide reframed the practice around planning patch management and vulnerability remediation for information technology, giving organizations a published process to follow rather than ad hoc patching.
2013 Feb
A consortium including PayPal, Lenovo, and Nok Nok Labs forms to develop open authentication standards. The alliance later adds Apple, Google, and Microsoft, and its specifications become the foundation for phishing-resistant MFA.
2013 Feb
NIST published a request for information after Executive Order 13636. Public input and workshops began the Framework development process.
2013 Apr
Revision 4 grew the catalog to eighteen families and added supply chain risk management controls. It responded to evolving threats and reinforced the need for tailored, risk-informed control selection.
2013 Apr 8
STIX 1.0 established a released schema for campaigns, indicators, incidents, threat actors, courses of action, and related CTI components.
2013 Jul
The Diamond Model formalized intrusion events around adversary, capability, infrastructure, and victim, with relationships used for analytic pivoting and activity grouping.
2013 Jul
NIST released a preliminary Framework based on the request for information and public workshops. It gave stakeholders a concrete draft to discuss before the first release.
2013 Sep
CryptoLocker paired malware distribution with encryption and a payment workflow. The Canadian Centre for Cyber Security identifies it as the first modern ransomware campaign.
2013 Sep
MITRE created the first ATT&CK model to organize adversary behavior observed during research into post-compromise detection.
2013 Oct
The 2013 edition reorganized the ISMS requirements around the common management-system structure and strengthened the risk-based approach, making the standard easier to align with other management systems.
2013 Oct
The companion controls standard was revised alongside 27001, keeping 114 controls as the reference for implementing information security management controls.
2013 Oct
The Open Group publishes the Open FAIR Risk Analysis (O-RA) Standard version 1.0, giving quantitative risk analysis a published standard for estimating loss frequency and loss magnitude.
2013 Nov
Version 3.0 added an in-scope system-component inventory requirement in its published change summary. Inventory became an explicit input to configuration standards and assessment scope.
2014
The CryptoLocker model spread through malicious attachments and broad campaigns from 2014 through 2016. Defense therefore needed to cover access paths and endpoints at scale.
2014 Jan 19
The Linux kernel added nftables as the successor to iptables, using a flexible ruleset representation and a new userspace interface.
2014 Feb
CISA's alert documented UDP-based amplification vectors and mitigation considerations. Reflection and spoofed-source traffic became a routine part of defensive planning.
2014 Feb
NIST released Framework Version 1.0 for improving critical-infrastructure cybersecurity. Organizations, regulators, and customers could use its structure to guide and assess programs.
2014 Feb
The first Cybersecurity Framework provided voluntary, risk-based guidance for managing critical-infrastructure cybersecurity. It gave network controls a shared way to connect technical work to organizational risk outcomes.
2014 Feb 12
NIST released a voluntary framework for improving critical infrastructure cybersecurity. Its five functions gave organizations a common structure for managing cybersecurity risk.
2014 Feb 12
NIST releases the Cybersecurity Framework Version 1.0 as a voluntary, risk-based structure whose Identify, Protect, Detect, Respond, and Recover functions carry the outcomes of risk decisions.
2014 Feb 26
The OpenID Foundation ratified an identity layer over OAuth 2.0. ID Tokens, claims, issuer identifiers, and relying-party validation enabled interoperable web sign-in with JSON-based artifacts.
2014 Apr
RFC 7208 replaced RFC 4408 and clarified SPF evaluation and deployment. SPF remained evidence about SMTP identities rather than visible From identity.
2014 Dec
The Act directed NIST to facilitate and support voluntary, consensus-based approaches to reducing cyber risk. It gave the Framework work an ongoing statutory basis.
2014 Dec
The Universal Second Factor specification defines a browser-based protocol for using external authenticators like security keys as a second factor. Google and GitHub begin supporting it, demonstrating phishing-resistant authentication in production.
2015 Mar
DMARC combined SPF and DKIM results with visible From alignment, published policy, and reporting. Domain owners gained a feedback loop for mail using their domains.
2015 Apr
Microsoft began previewing DLP for SharePoint Online and OneDrive for Business, adding policy evaluation to cloud content stores. Enforcement started to follow data into hosted repositories, not just mail flow.
2015 Apr
The SAQ change history records an update to align the tool with PCI DSS v3.1. Reporting artifacts continued to move with the standard.
2015 May
MITRE released Enterprise ATT&CK with 96 techniques, turning an internal research model into a public behavior knowledge base for defenders.
2015 Jun
OASIS formed the CTI Technical Committee to standardize and continue development of STIX, TAXII, and CybOX under an open standards process.
2015 Sep
Microsoft began the general rollout of DLP across OneDrive for Business, SharePoint Online, and the Office 2016 desktop apps. Policy tips inside the editing applications brought data-in-use feedback to end users.
2015 Sep
The IETF standardized HTTP-based user and group management across domains. Provisioning could use a shared schema and protocol independently from the sign-in federation path.
2015 Dec
NIST requested information on organizations' experience with the Framework. The feedback informed the update process after Version 1.0.
2016 Feb
The paper defined hunting as a focused, iterative search for adversaries already inside an organization. It framed hypothesis generation and dedicated analysts as parts of the practice.
2016 Apr
PCI SSC released version 3.2 to replace v3.1 in response to growing threats to payment information. The standard remained a living security baseline rather than a fixed checklist.
2016 Apr
The Auditing Standards Board issued SSAE No. 18, clarifying and recodifying attestation standards into AT-C sections for examinations such as SOC engagements.
2016 Apr 27
The European Parliament and the Council adopted Regulation (EU) 2016/679, giving the GDPR its final legal text.
2016 May 24
The Regulation entered into force, starting the transition period before its rules became applicable.
2016 Aug 31
FIRST released a consolidated TLP 1.0 definition and usage guide, replacing community variation with a common set of sharing designations.
2016 Oct
CISA alerted organizations to Mirai activity using compromised Internet-connected devices. Defensive planning had to account for large, distributed sources outside conventional server botnets.
2017
The AICPA Assurance Services Executive Committee issued the 2017 Trust Services Criteria, renaming the former principles framing, aligning structure with COSO 2013, and strengthening cybersecurity-oriented supplemental criteria used in SOC 2.
2017
The project encoded a repeatable collection of Windows analysis tools and environment configuration for installation inside a virtual machine.
2017
Gartner issued its final Magic Quadrant for Enterprise Data Loss Prevention and replaced it the next year with a Market Guide. The change reflected a market Gartner viewed as mature and increasingly delivered inside email, endpoint, and cloud-access platforms.
2017
The survey documented how practitioners described and organized threat hunting. It made the emerging practice measurable enough to compare approaches and maturity.
2017
Sigma introduced a shared rule format, tools, and collections for describing log detections across analysis platforms. Detection content could be reviewed and translated without beginning in one vendor's query language.
2017 Jan
The first draft update added supply-chain-risk detail, clarified terms, and introduced cybersecurity measurement discussion. It made the revision process visible for public comment.
2017 Jan
The Sigma repository's early history begins in January 2017. Sigma developed as a generic structured format for sharing log-detection logic across monitoring platforms.
2017 Jan
The Sigma project began publishing a generic format for describing log detections. Detection authors gained a shared representation that tooling could translate for different SIEM backends.
2017 Mar 30
The packaged release reduced setup friction and moved automated sandboxing toward a more maintainable analyst service.
2017 May
WannaCry remotely compromised systems, encrypted files, and affected organizations in more than 150 countries. It made patching and network exposure central ransomware-resilience concerns.
2017 May 1
SSAE 18 became effective for practitioners' reports dated on or after May 1, 2017, becoming the attestation framework for SOC 1, SOC 2, and SOC 3 examinations.
2017 Jun
NotPetya exploited vulnerabilities, gained privileged rights, and rendered infected Windows computers unusable. The event reinforced that recovery planning must address essential systems, not only user files.
2017 Oct 27
OASIS published redesigned STIX 2.0 and an HTTPS-based TAXII 2.0 API as approved Committee Specifications ready for implementation and interoperability testing.
2017 Dec
NIST published a second proposed update to clarify and refine the Framework. It incorporated another round of public review before the final release.
2018
The AICPA issued description criteria for management's SOC 2 system description, separating description evaluation from control evaluation against the Trust Services Criteria.
2018
NIST publishes SP 800-37 Revision 2, integrating privacy controls alongside security controls in the Risk Management Framework and reinforcing the authorization-to-operate decision as risk acceptance.
2018 Jan
ATT&CK began a public version history with v1.0. Stable versions made it practical to record which technique vocabulary a hunt, analytic, or coverage review used.
2018 Feb
The overview-and-vocabulary standard was updated, clarifying the terms and concepts the 27000 family uses. It supplies the shared definitions the family depends on.
2018 Feb
GitHub reported a 1.35 Tbps, 126.9 million-packet-per-second attack using publicly reachable memcached instances with UDP enabled. The incident showed why upstream diversion and filtering remain necessary even after adding transit capacity.
2018 Apr
Version 1.1 added self-assessment material, expanded supply-chain-risk guidance, and clarified the relationship between Profiles and Tiers. The update remained compatible with Version 1.0.
2018 Apr
Version 1.1 added and clarified self-assessment, supply-chain risk, identity, and coordinated vulnerability disclosure. Security operations could map operational evidence to a refined risk-management framework.
2018 Apr 16
NIST released version 1.1 with refinements for identity, supply-chain risk management, self-assessment, and coordinated vulnerability disclosure. It remained compatible with version 1.0.
2018 May 25
The GDPR became applicable across the EU, making its requirements operational for organizations processing covered personal data.
2018 Sep
MTA-STS defined a policy mechanism for requiring authenticated TLS when mail is delivered to a domain. It strengthened transport protection as a distinct email-security layer.
2018 Oct
The update moved the older site aside and directed users to the newer site and STIX/TAXII data for current content. That made technique data easier to consume in tooling as well as in the browser.
2018 Oct
Project leadership renamed Bro to Zeek while retaining its long-developed network analysis model. The change marked continuity of the monitoring platform and its community under a new name.
2018 Oct 23
Parliament and Council adopted the EUDPR, extending the reformed framework to EU institutions, bodies, offices, and agencies.
2018 Dec
SP 800-37 Revision 2 integrated the RMF across the system development life cycle and added a Prepare step. The seven-step framework became the standard sequence for selecting, implementing, assessing, authorizing, and monitoring controls.
2019
CISA records ABCD ransomware activity in September 2019 as the predecessor to LockBit. The operation's later affiliate model illustrated why defender observations vary across incidents.
2019 Feb
Microsoft announced Azure Sentinel as cloud-based technology for cyber defenders. It placed data collection, analytics, incidents, hunting, and orchestration in a cloud service.
2019 Feb
Microsoft announced a cloud-native SIEM built into Azure. The service connected cloud-scale collection and analytics with hunting and automated response.
2019 Mar
The Web Authentication API becomes an official W3C Recommendation, enabling browsers and relying parties to use public-key credentials for authentication. This is the moment FIDO moves from a plugin model to a native browser capability.
2019 Mar 4
W3C and the FIDO Alliance finalized Web Authentication as a web standard for public-key credentials. Browsers and platforms gained a common API for phishing-resistant authenticator ceremonies.
2019 Mar 5
The public release provided a free, extensible reverse-engineering suite with disassembly, decompilation, scripting, and collaboration features.
2019 Apr 4
Publishing the source enabled community inspection, patches, extensions, and builds across supported platforms.
2019 May
ARC standardized a way to preserve authentication assessments across intermediaries. It addressed evidence loss in forwarding and mailing-list paths without replacing DMARC.
2019 Jun
Elastic introduced Elastic SIEM with a common schema and workflows for host and network data. It made a search and data platform a direct location for security investigation.
2019 Jun
Elastic introduced a dedicated SIEM application for host and network investigation workflows. It joined common-schema event data with a security-focused analyst interface.
2019 Nov
Broadcom completed its 10.7 billion dollar purchase of Symantec's enterprise security business, including Symantec DLP. The former parent renamed itself NortonLifeLock and kept the consumer products.
2019 Nov
Google described Backstory as its flagship hybrid security analytics offering while consolidating Chronicle into Google Cloud. The move placed large-scale security analytics inside a major cloud platform.
52 milestones
2020
LockBit-named ransomware was first seen on cybercrime forums in January 2020. The service model separated ransomware development from affiliate intrusion activity.
2020
NIST SP 1800-31 documented an example enterprise patch-management approach using automated asset discovery, assessment, prioritization, deployment, and monitoring.
2020 Jun 24
The Commission published its first report on applying the GDPR, shifting attention from preparation to implementation experience.
2020 Jul
The first non-beta Enterprise release with sub-techniques made technique descriptions more specific. Hunters could use a more precise behavior label when forming and documenting a hypothesis.
2020 Aug
NIST SP 800-207 described zero trust as moving defenses from static network perimeters toward users, assets, and resources. It formalized the shift from location-based trust to explicit access decisions.
2020 Aug 11
NIST SP 800-207 narrowed defenses from broad network perimeters toward resources and removed implicit trust based only on network location. Firewalls remained enforcement points within a wider policy architecture.
2020 Sep
Microsoft added native endpoint enforcement to Microsoft 365 DLP, covering USB copy, network shares, cloud uploads, printing, and clipboard on Windows 10 without a separate agent. Endpoint coverage became part of the same policy set as email and SharePoint.
2020 Sep
Revision 5 consolidated security and privacy controls, organized them by family, and moved baseline definitions into the separate SP 800-53B. The management, operational, and technical class structure was replaced by family-based organization.
2020 Sep 23
NIST integrated security and privacy controls into one catalog and added a supply-chain risk management control family. The revision broadened control selection beyond isolated technical safeguards.
2020 Oct
The release retired the separate PRE-ATT&CK domain and added reconnaissance and resource development tactics to Enterprise ATT&CK. This expanded the behavior model around activity that precedes access to an environment.
2020 Oct
NIST publishes IR 8286, Integrating Cybersecurity and Enterprise Risk Management, introducing the cybersecurity risk register as the construct that rolls security exposure up into enterprise risk language.
2021 Apr
The version history records v9.0 as the next major ATT&CK release. Continuing versioned updates kept the behavior vocabulary that hunters use subject to explicit, reviewable change.
2021 May
CIS Controls v8 reorganized its safeguards around activity rather than device ownership and trimmed the set to eighteen controls with 153 safeguards. It preserved the model of prioritization through implementation groups.
2021 May
The attack temporarily disrupted gasoline delivery across much of the southeastern United States. It showed how a cyber incident can quickly become an operational continuity event.
2021 Jun
CISA records LockBit 2.0 and its StealBit tool in June 2021. The change reflects the defense problem covered here; restoration alone does not settle data-extortion risk.
2021 Jun 10
OASIS members approved STIX 2.1 and TAXII 2.1 as full standards, consolidating the JSON graph model and aligned exchange protocol used by modern CTI systems.
2021 Oct
HelpSystems, later renamed Fortra, acquired Digital Guardian, one of the last large independent enterprise DLP vendors. Standalone DLP suites kept being absorbed into broader data-security portfolios.
2021 Nov
Binding Operational Directive 22-01 created a living catalog of vulnerabilities known to be exploited. It made documented exploitation a distinct prioritization input for vulnerability-management programs.
2021 Nov
CISA launched the Known Exploited Vulnerabilities catalog of CVEs with reliable evidence of active exploitation, and Binding Operational Directive 22-01 required federal agencies to remediate listed vulnerabilities on a fixed schedule. The exploited catalog, not severity, became the deadline.
2022
NIST began the CSF 2.0 development journey, opening a new cycle of concept work, drafts, reference-tool development, and stakeholder feedback.
2022
Parallel revisions updated implementation guidance for the 2018 SOC 2 description criteria used to evaluate management's system description.
2022
The AICPA published revised points of focus for the 2017 Trust Services Criteria, updating interpretive guidance used when applying the criteria in SOC 2 examinations.
2022 Feb
The 2022 edition reorganized information security controls into organizational, people, physical, and technological themes and consolidated the set from 114 to 93 controls. Organizations select from them within an ISO/IEC 27001 management system.
2022 Feb
The 2022 edition condensed the controls into 93 items grouped in four themes — organizational, people, physical, and technological — consolidating 56 of the 2013 edition's 114 controls into 24 and adding new ones.
2022 Mar 31
PCI SSC published v4.0 with changes intended for emerging threats and technologies, including a broader network-security framing and added flexibility in meeting security objectives.
2022 Jun
Revision 4 extended the guide to enterprise patch management across IT and operational technology and framed patching as preventive maintenance, an ongoing cost of running technology. It defines the identify, prioritize, acquire, install, and verify cycle the course uses.
2022 Aug
AWS and partners announced the Open Cybersecurity Schema Framework project. It provided an open schema effort for normalizing security telemetry across producers and consumers.
2022 Aug
AWS and partners released OCSF as an open specification for normalizing security telemetry across products and services. It addressed the common-schema stage that enables cross-source analytics.
2022 Aug 5
FIRST updated TLP after a multiyear industry consultation, revising the designations and guidance used to control redistribution of shared security information.
2022 Sep
An attacker flooded a contractor with push notifications until one was approved, then used social engineering via WhatsApp to pressure the approval. The incident becomes the canonical example of push bombing and accelerates adoption of number matching and transaction context in push-based MFA.
2022 Oct
The risk management guidance standard was updated to align with ISO 31000, giving the family's risk process a dedicated, current reference.
2022 Oct 25
The requirements edition was revised to match the 27002 control structure, with four themes replacing the older domains and new requirements including planned change (Clause 6.3) and explicit ISMS processes (Clause 4.4).
2022 Nov
Stakeholder-Specific Vulnerability Categorization turned exploitability and impact inputs into four decisions, Track, Track star, Attend, and Act. It gave organizations a decision framework for urgency instead of a raw score.
2022 Nov
The Common Security Advisory Framework standardized machine-readable advisories with product status values and remediation categories. Advisories became data that an automated queue could consume instead of prose for a human to read.
2023 May
The three major platform vendors announce synchronized passkey support across their ecosystems. A 2024 FIDO Alliance survey finds fifty-three percent of people have enabled passkeys on at least one account, signaling the transition from security-key-only FIDO to consumer-scale passwordless authentication.
2023 Jun
The advisory documented LockBit activity, affiliate variation, and mitigation recommendations. It connected ransomware response to continual testing of controls against observed attacker techniques.
2023 Aug
NIST released the public draft of CSF 2.0 and associated implementation examples for comment. The draft invited review of changes intended to address current and future cybersecurity challenges.
2023 Sep
Scattered Spider impersonated an MGM employee over the phone, got the IT help desk to reset MFA, and deployed ransomware across 30+ properties. The $100 million loss demonstrates that MFA protection collapses when help-desk recovery procedures rely on knowledge factors available in breach databases.
2023 Sep 30
AICPA & CIMA listed the consolidated 2017 Trust Services Criteria with 2022 revised points of focus as a current free download resource for practitioners and service organizations.
2023 Oct
NIST published a new planning guide focused on organization-wide improvement of cybersecurity log management. The revision reframed log management as a continuing program of generation, transmission, storage, access, and disposal.
2023 Oct
Attackers extracted HAR files containing session tokens from Okta customer support system, bypassing MFA entirely because the tokens represented already-authenticated sessions. The incident affects roughly 18,000 customer accounts and reinforces that session lifecycle management is part of MFA real assurance boundary.
2023 Nov
Version 4.0 introduced four metric groups and the CVSS-B, CVSS-BT, CVSS-BE, and CVSS-BTE nomenclature, making explicit which parts of a score are base characteristics and which add threat and environment. A bare base score no longer stands in for urgency.
2023 Nov
NIST updated the catalog with a small set of identity-focused additions and published the interactive Control Reference Tool for browsing controls and enhancements. Machine-readable OSCAL formats continued alongside the tooling.
2024 Feb
NIST released CSF 2.0 for organizations in every sector. The update added the Govern Function and expanded the Framework's scope beyond critical infrastructure.
2024 Feb
Gmail required bulk senders to use SPF, DKIM, and DMARC, alongside TLS and spam-rate requirements. Authentication became a delivery prerequisite for many senders.
2024 Feb
CSF 2.0 expanded the framework's intended audience and added the Govern function. Network security planning gained a clearer link between technical controls, enterprise risk decisions, and supply-chain context.
2024 Feb 23
ISO/IEC 27001:2022/Amd 1:2024 introduced climate action changes to the standard, adding the consideration of climate-related risk to the ISMS context and risk process.
2024 Feb 26
NIST publishes CSF 2.0, adding the Govern function and elevating risk governance and strategy to the same structural level as the operational functions, with risk assessment outcomes carried in Govern and Identify.
2024 Feb 26
NIST released CSF 2.0 for organizations of any sector or size and added the Govern function. The framework now organizes cybersecurity risk outcomes around six concurrent functions.
2024 Mar
The requirements for bodies that audit and certify ISMSs were reissued as 27006-1:2024, aligning certification-body competence with the current 27001 edition.
2024 Jun 11
PCI SSC published v4.0.1 as a limited revision that clarified and corrected v4.0 without adding or deleting requirements. Practitioners moved to the maintained version while preserving the underlying control set.
2025 Apr
Revision 3 superseded Revision 2 and expressed incident response as a CSF 2.0 community profile. Practice moved from a standalone lifecycle guide toward recommendations integrated across cybersecurity risk management.