openskills.info
← Security Engineer career guide

Security

Security Engineer timeline

How the field of a Security Engineer got here: the sourced milestones from every published course of this career, on one axis.

1975 to 2025

490 milestones across 51 courses

  • Core
  • Supporting
  • Specialization

The axis stretches toward recent years, where most milestones fall. Bars count milestones per year; dots are single milestones.

Before 1990

20 milestones

  1. 1975 Sep

    Saltzer and Schroeder publish eight protection principles

    The paper organized recurring protection choices into eight design principles, including fail-safe defaults, complete mediation, open design, and least privilege.

  2. 1976 Nov

    Diffie and Hellman publish public-key cryptography

    The paper introduced public-key distribution and digital-signature concepts. It established the cryptographic foundation that PKI later governs at scale.

  3. 1977 Jan 15

    DES becomes FIPS 46

    The U.S. standard specified a shared-key encryption algorithm for protecting sensitive computer data and placed implementation in electronic devices.

  4. 1978 Feb

    RSA public-key cryptosystem is published

    Rivest, Shamir, and Adleman published a practical public-key encryption and signature method. RSA became one of the algorithms used with public-key certificates.

  5. 1980

    OECD Privacy Guidelines adopted

    The OECD issued privacy principles for personal-data protection and transborder data flows. The principles gave later engineering and regulatory work a shared vocabulary for collection, use, safeguards, openness, participation, and accountability.

  6. 1980 Apr

    Anderson frames threat monitoring and surveillance

    James P. Anderson's report described using audit information to distinguish normal use from suspected misuse. It established audit review as a basis for automated intrusion detection research.

  7. 1982 Apr 14

    FIPS 140 addresses cryptographic equipment

    The standard defined general security requirements for equipment that implemented DES, extending attention from the algorithm to its operating boundary.

  8. 1982 Aug

    SMTP is specified in RFC 821

    SMTP standardized interoperable mail transfer and relay. Its store-and-forward design created the cross-domain trust boundary that later email-security controls protect.

  9. 1983

    Fred Cohen conducts early computer-virus experiments

    Cohen's controlled experiments and later publication formalized computer viruses as a subject for technical study rather than only an operational incident.

  10. 1984

    Bellcore patents the first RSA-based authentication system

    The foundational patent for challenge-response authentication using public-key cryptography, which later underpinned hardware token systems for decades.

  11. 1985 Aug

    The IDES requirements and model are documented

    Dorothy Denning and Peter Neumann documented requirements for a real-time Intrusion-Detection Expert System. The work connected statistical profiles and expert-system rules to system audit records.

  12. 1985 Dec

    The Orange Book formalizes trusted-system evaluation criteria

    The final Trusted Computer System Evaluation Criteria connected security features with assurance requirements and defined graded evaluation classes for computer systems.

  13. 1986

    RSA Security introduces SecurID

    The first widely deployed hardware OTP token, generating codes from a time-synchronized algorithm. SecurID became the enterprise standard for second-factor authentication for over two decades.

  14. 1987

    Computer Security Act establishes federal responsibility

    The Act assigned NBS, later NIST, responsibility for computer security standards for unclassified federal systems. It established a durable public role for program guidance and training.

  15. 1987 Feb

    Denning publishes An Intrusion-Detection Model

    The model described detecting security violations through abnormal patterns in audit records. It gave the field a general framework independent of a particular system or vulnerability.

  16. 1988 Nov

    CERT Coordination Center is created after the Morris Worm

    The Morris Worm disrupted the early Internet on November 2, 1988. DARPA asked the Software Engineering Institute to establish the coordination center that became CERT/CC so incident analysis and communication could be coordinated.

  17. 1988 Nov

    First X.509 recommendation defines an authentication framework

    CCITT X.509 specified public-key certificates, certification authorities, and strong authentication within the Directory. It supplied the certificate model used by later Internet profiles.

  18. 1988 Nov 2

    Morris Worm and CERT/CC formation

    The Morris Worm disrupted the early Internet. DARPA asked the Software Engineering Institute to establish the CERT Coordination Center to coordinate vulnerability reporting and incident response.

  19. 1988 Nov 25

    X.500 directory recommendation approved

    ITU approved X.500 as an overview of directory concepts, models, and services. Directory standards gave distributed identity records a common information and service model.

  20. 1989

    PC Cyborg, also called the AIDS Trojan, appears

    The first ransomware attack used infected diskettes and a ransom demand after repeated system reboots. It established the extortion pattern before modern internet-scale delivery.

1990s

42 milestones

  1. 1990

    FIRST forms to connect incident response teams

    The Forum of Incident Response and Security Teams formed after separate response teams encountered coordination problems across constituencies, languages, and time zones. Security response gained a continuing international coordination forum.

  3. 1991

    Pretty Good Privacy is released

    PGP made public-key cryptography and signatures broadly available in software. Its message and key concepts became the basis for the later OpenPGP format.

  4. 1991 Jun 13

    DEC SEAL enters service

    Digital Equipment Corporation delivered the SEAL firewall, combining a packet-filtering gateway with application proxy and mail components. It became an early commercial firewall architecture.

  5. 1992 Apr

    SAS 70 issued

    The AICPA issued Statement on Auditing Standards No. 70 for reporting on controls at service organizations, which became the dominant US mechanism for those examinations for nearly two decades.

  6. 1992 Oct

    NIST researchers publish a general RBAC model

    Ferraiolo and Kuhn presented a formal role-based access control model in which access is mediated through roles. The model generalized earlier application-specific role controls.

  7. 1993 Feb

    RFC 1422 defines certificate-based key management for PEM

    RFC 1422 specified a certificate-based approach to key management for Internet privacy-enhanced mail. It showed an early Internet use of X.509 certificates and defined validity intervals as an operational concern.

  8. 1993 Feb

    RFC 1422 profiles certificate-based key management for Internet mail

    Privacy Enhanced Mail used X.509 certificates and a hierarchical policy structure for Internet email. The document is now Historic, but it records an early Internet PKI design.

  10. 1993 Jul

    RFC 1487 specifies X.500 LDAP

    The first LDAP RFC defined a lightweight access protocol for clients that could not carry the full X.500 Directory Access Protocol stack.

  11. 1993 Sep

    Kerberos Version 5 published as RFC 1510

    The IETF specification documented ticket-based authentication across network services. Managed environments could reuse a central authentication relationship without sending a password to every service.

  12. 1994

    Common Criteria version 1.0 issued

    Canada, France, Germany, the Netherlands, the United Kingdom, and the United States unified earlier evaluation criteria. This created shared vocabulary for evaluating security properties across markets.

  13. 1994 Jan 11

    FIPS 140-1 defines four module levels

    FIPS 140-1 set security requirements for cryptographic modules across interfaces, roles, physical security, software, key management, and self-tests.

  14. 1994 Nov

    Shor publishes quantum factoring and discrete-logarithm algorithms

    The result established a polynomial-time quantum attack on the mathematical problems underlying major public-key systems.

  15. 1994 Dec

    NIST publishes SP 800-10

    NIST documented firewall components, access policies, and implementation choices to help organizations plan and purchase Internet firewalls.

  16. 1995

    Bro begins at Lawrence Berkeley National Laboratory

    Vern Paxson designed and implemented the initial Bro network monitor. Its event-oriented analysis later continued under the Zeek name.

  17. 1995

    IETF establishes the PKIX working group

    The PKIX working group began work on Internet standards for X.509-based public key infrastructures. Its charter connected certificate formats to interoperable Internet deployment and validation practice.

  18. 1995

    NIST and IETF begin the PKIX working group

    PKI standards work shifted toward the IETF, and the PKIX group developed Internet profiles for X.509. This work connected the general X.509 framework to interoperable Internet use.

  19. 1995 Feb

    SSL 2.0 published with Navigator 1.1

    Netscape released SSL 2.0 as the first public transport encryption protocol for the web. Its design limitations—MD5-only MAC, shared encryption and authentication key, unprotected handshake—drove a complete redesign within a year.

  20. 1995 Mar

    RFC 1777 revises LDAP

    The revised protocol replaced RFC 1487 and documented the bind, search, modify, add, delete, Modify RDN, compare, abandon, and unbind operations.

  21. 1995 Oct

    EU Data Protection Directive adopted

    Directive 95/46/EC established a European legal framework for personal-data processing. It made system processing practices a sustained regulatory concern rather than a policy-only topic.

  22. 1995 Oct

    NIST publishes the original SP 800-12 handbook

    The handbook organized information security policy, program management, and control concepts into public federal guidance. It gave practitioners a durable vocabulary for connecting management direction to safeguards.

  23. 1995 Oct

    NIST SP 800-12 establishes a broad security handbook

    The original Introduction to Computer Security organized foundational security principles and management concerns for organizations.

  24. 1996 Jul

    Grover publishes quantum search algorithm

    The algorithm established a quadratic speedup for unstructured search, shaping how symmetric key sizes are assessed under a quantum threat model.

  25. 1996 Nov

    SSL 3.0 specification published

    A complete protocol redesign by Kocher, Karlton, and Freier separated data transport from the message layer and added Diffie-Hellman key exchange. SSL 3.0 became the foundation for all subsequent TLS versions.

  26. 1997 Sep

    RFC 2196 documents site firewall practice

    The Site Security Handbook described filtering, proxy services, and firewall architecture as parts of Internet-connected site security.

  27. 1997 Dec

    LDAPv3 is published in RFC 2251

    LDAPv3 added an extensible message structure and became the protocol generation on which current LDAP specifications are based.

  29. 1998 Mar

    S/MIME Version 2 is specified in RFC 2311

    S/MIME described cryptographic message content protection for MIME mail. It established a message-level alternative to protecting only the transport connection.

  30. 1998 Aug

    OpenLDAP 1.0 is released

    The OpenLDAP Project published its first release, establishing an open implementation with server, client, and library components.

  31. 1998 Nov

    IPsec security architecture is standardized

    RFC 2401 defined a security architecture for IP traffic using authentication, encapsulation, and security associations. It gave site-to-site and host-to-host protection a common standards-track foundation.

  32. 1998 Nov

    RFC 2440 defines OpenPGP

    RFC 2440 standardized OpenPGP message formats, signatures, keys, and certificates. Software signing could then use an interoperable public-key format rather than a single implementation's convention.

  33. 1999

    Common Criteria became ISO/IEC 15408

    International standardization extended the common evaluation criteria beyond the original government collaboration. Product assurance and configuration claims gained a common international reference.

  35. 1999

    STRIDE is introduced at Microsoft

    Loren Kohnfelder and Praerit Garg's internal paper introduced STRIDE. The taxonomy gave software teams a repeatable way to enumerate threats during design analysis.

  36. 1999 Jan

    RFC 2459 publishes the first Internet X.509 certificate and CRL profile

    The PKIX profile standardized certificate and revocation-list use for Internet applications. Later revisions refined the validation model and profiles.

  37. 1999 Jan

    RFC 2459 publishes the Internet X.509 PKI profile

    RFC 2459 profiled X.509 certificates and certificate revocation lists for Internet use. It made extensions and certification-path processing central parts of interoperable certificate handling.

  38. 1999 Jan

    TLS 1.0 published as RFC 2246

    The IETF standardized SSL as Transport Layer Security. TLS 1.0 replaced the custom MAC with HMAC and expanded alert codes, but remained close enough to SSL 3.0 that downgrade attacks were a known concern from the start.

  39. 1999 Jun

    HTTP/1.1 is standardized

    RFC 2616 standardized HTTP/1.1. Its method, header, and response model became a common transport surface for web APIs and their security controls.

  40. 1999 Aug

    RFC 2647 standardizes firewall performance terms

    RFC 2647 defined common terms for packet filtering, stateful filtering, proxies, rulesets, and protected networks so implementations could be discussed and benchmarked consistently.

  41. 1999 Sep

    CVE List launches publicly

    The CVE Program launched its public list with a common set of identifiers for known vulnerabilities. Security teams and products gained a shared reference for exchanging vulnerability information.

  42. 1999 Sep

    Simple paged results are documented

    RFC 2696 defined a control and opaque cookie exchange for retrieving a large search result in pages.

2000s

109 milestones

  1. 2000

    Active Directory ships with Windows 2000

    Active Directory Domain Services first became available with Windows 2000. It established the domain-controller directory that later security controls protect.

  2. 2000

    Shibboleth project begins

    Shibboleth grew from an Internet2 middleware initiative and connected with the OASIS SAML work. It established an open federation path for research and education institutions.

  3. 2000 May

    StartTLS is standardized for LDAPv3

    RFC 2830 defined the extended operation that begins TLS on an LDAP association, providing confidentiality, integrity, and optional authentication.

  4. 2000 Oct

    RFC 2979 specifies firewall behavior requirements

    The RFC documented interoperability requirements and showed how filtering could disrupt Path MTU Discovery and application protocol negotiation.

  5. 2001

    Vontu founded to build policy-based leak prevention

    Vontu launched in San Francisco to detect and block disclosure of sensitive data by policy. Its product was later described as the first to combine endpoint and network coverage for data at rest, in motion, and in use, the three-state framing DLP still uses.

  6. 2001 May 25

    FIPS 140-2 updates module requirements

    FIPS 140-2 replaced FIPS 140-1 and retained four qualitative security levels while updating the areas used to assess cryptographic modules.

  7. 2001 Jun

    NIST publishes its baseline IT security engineering principles

    NIST SP 800-27 moved system-level principles into federal guidance for the design, development, and operation of information systems.

  8. 2001 Aug

    BSD syslog behavior documented in RFC 3164

    RFC 3164 documented the widely implemented BSD syslog message and relay model. It gave centralized collectors a shared reference while also recording delivery and security limitations.

  10. 2001 Nov

    NIST publishes SP 800-31 on intrusion detection

    NIST published an enterprise primer on selecting, configuring, managing, and integrating intrusion detection systems. It formalized IDS as part of organizational security infrastructure.

  11. 2001 Nov 26

    AES becomes FIPS 197

    FIPS 197 standardized AES with 128-bit blocks and three supported key sizes, creating the symmetric cipher foundation used by later key hierarchies.

  12. 2001 Dec

    OWASP Foundation launches

    OWASP launched as an open community focused on improving software security. Its projects made application-security guidance broadly accessible to development teams.

  13. 2001 Dec 1

    OpenBSD 3.0 releases PF

    OpenBSD introduced PF as its packet filter with network address translation. The project later documented filtering, tables, logging, traffic control, and redundancy around the same system.

  14. 2002

    NGINX development begins

    Development began to address high concurrent-connection workloads with an event-driven architecture. That origin explains why NGINX became a common edge component whose listeners and request-processing path need explicit protection.

  15. 2002

    NIST published Windows 2000 security administration guidance

    NIST SP 800-43 provided system administration guidance and configuration checklists for Windows 2000 Professional. It was an early step toward reusable product-specific secure configuration guidance.

  16. 2002

    OWASP Developer Guide version 1.0 released

    The first Developer Guide established an early developer-facing reference for secure development practice.

  17. 2002

    Trustworthy Computing drives security process changes

    Microsoft's Trustworthy Computing directive led product groups to run security pushes that included threat modeling and mitigation. It moved the practice toward a development-process expectation.

  18. 2002 Jan

    Microsoft launches Trustworthy Computing

    Microsoft started Trustworthy Computing in response to the changing security environment. The initiative made security a development concern instead of a late product concern.

  19. 2002 Jan

    NIST publishes SP 800-41

    NIST issued dedicated guidance on firewall technologies and policy, turning deployment and management into a documented security lifecycle.

  20. 2002 Apr

    RFC 3280 updates the certificate and CRL profile

    RFC 3280 replaced RFC 2459 as the Internet X.509 certificate and CRL profile. It carried the profile forward for certificate construction and path validation.

  21. 2002 Sep

    RFC 3377 consolidates LDAPv3

    The technical specification assembled the RFC set required for an LDAPv3 implementation and clarified the standards baseline.

  22. 2002 Nov

    NIST publishes wireless-network security guidance

    NIST SP 800-48 set out security recommendations for wireless networks as WLAN use expanded. It established that radio networks needed dedicated configuration, access-control, and monitoring treatment.

  23. 2002 Nov

    SAML 1.0 becomes an OASIS Standard

    OASIS ratified the first SAML standard, establishing an XML framework for exchanging authentication and authorization information.

  25. 2002 Dec

    FISMA requires agency-wide programs

    FISMA tasked NIST with federal standards and guidelines and required documented agency-wide information security programs.

  26. 2003

    Constrained delegation arrives with the Windows Server 2003 functional level

    The Windows Server 2003 functional level added constrained delegation. Delegation became a configuration surface requiring explicit security review rather than a purely application concern.

  28. 2003

    Shibboleth 1.0 is released

    The first Shibboleth identity-provider release made SAML federation deployable in research and education communities. Institutions could operate their own IdPs and exchange attributes with participating services.

  29. 2003 Aug

    NIST SP 800-55 published

    NIST published its initial guide for using performance measures to assess information security controls, policies, and procedures.

  30. 2003 Sep

    SAML 1.1 becomes an OASIS Standard

    Version 1.1 incorporated implementation experience and refined the assertion, protocol, binding, and profile set.

  31. 2003 Nov

    RFC 3647 standardizes the CP and CPS framework

    The framework organized the topics covered by certificate policies and certification practice statements. Operators gained a common structure for documenting governance and operational controls.

  32. 2004

    Microsoft makes SDL mandatory

    Microsoft made its Security Development Lifecycle part of its software development process, integrating security work across design, development, and testing.

  34. 2004

    Microsoft SDL makes threat modeling a lifecycle activity

    The Security Development Lifecycle became integral to Microsoft's development process. Threat modeling was established as a design-phase activity alongside security testing and review.

  35. 2004

    RSA SecurID reaches 40 million tokens deployed

    RSA hardware token install base demonstrates the market for something-you-have authentication, though cost and logistics keep it confined to regulated and enterprise environments.

  36. 2004

    Snort adds inline prevention capability

    Inline capability allowed Snort to stop malicious traffic instead of only reporting it. The operational concern expanded from detection accuracy to traffic-path availability and false-block impact.

  37. 2004

    Windows Firewall ships with Windows XP Service Pack 2

    Microsoft released Windows Firewall as a component of Windows XP Service Pack 2, moving host-based filtering into a widely deployed operating system baseline.

  39. 2004 Jun

    NIST revises the engineering-principles baseline

    Revision A clarified a structured foundation that covered technical countermeasures alongside policy, procedures, and user education.

  40. 2004 Jun 1

    VirusTotal launches collaborative multi-engine scanning

    VirusTotal made aggregated scanner results and shared sample context available through an online service, changing reputation lookup and collaborative triage.

  41. 2004 Jul

    Jericho Forum presents de-perimeterisation at Black Hat

    The Jericho Forum argued that a hard trusted-inside boundary could not support open collaboration. Its presentation shifted protection toward data, systems, interoperable controls, and defense in depth.

  42. 2004 Oct 4

    First public NGINX release

    NGINX 0.1.0 became publicly available. Operators could begin deploying the software as a web server and proxy, making configuration and exposed modules operational security concerns.

  43. 2004 Dec

    OWASP Testing Guide version 1.0 released

    The Testing Guide established a documented approach to web application security testing, separate from implementation guidance.

  44. 2005

    FastCGI and shared upstream handling arrive

    FastCGI support and a common upstream module expanded the ways NGINX could sit in front of application services. Hardening therefore had to consider both client-facing and upstream boundaries.

  45. 2005

    ISO/IEC 27001 first edition published

    ISO published the first ISO/IEC 27001 edition, establishing an information security management system standard. It made risk-based management and continual improvement a formal management-system path for information security.

  46. 2005

    Microsoft documents the SDL publicly

    Microsoft's public SDL material described threat modeling and testing as part of a repeatable secure-development process. The practice became accessible beyond its original internal use.

  47. 2005

    PLOVER organizes observed vulnerability examples

    MITRE grouped real CVE examples into common fault and flaw classes. The work supplied a bottom-up basis for a shared weakness taxonomy.

  48. 2005 Feb

    NIST SP 800-53 published

    NIST published a catalog for selecting and specifying security controls for federal information systems. It established a repeatable control selection approach that accounts for system categorization.

  49. 2005 Mar

    SAML 2.0 approved

    OASIS approved SAML 2.0 and unified federation building blocks from SAML, Shibboleth, and the Liberty Alliance. Its assertions, bindings, profiles, and metadata remain a common enterprise SSO integration boundary.

  51. 2005 Mar

    SAML 2.0 published

    OASIS published SAML 2.0, defining the assertion, binding, profile, and metadata vocabulary that underpins many enterprise browser SSO integrations.

  52. 2005 May

    NIST established the Security Configuration Checklists Program

    NIST SP 800-70 defined guidance for checklist users and developers while a public repository opened with more than one hundred checklists. Secure configuration guidance became easier to discover and reuse.

  53. 2005 Aug

    NIST publishes SP 800-57 Part 1

    The first final Part 1 assembled general guidance for cryptographic key types, protection, lifecycle, cryptoperiods, compromise, and recovery.

  54. 2005 Oct

    ISO/IEC 27001 first edition published

    ISO and IEC published ISO/IEC 27001:2005 for information security management systems. The standard tied risk-based management to the selection of proportionate controls for information assets.

  55. 2005 Oct

    ISO/IEC 27001 receives its first edition

    The first edition specified requirements for a documented information security management system in the context of organizational risk. It made the management system itself a certifiable requirements structure.

  56. 2005 Dec

    IETF publishes RFC 4226 (HOTP)

    The HMAC-Based One-Time Password algorithm standardizes event-driven OTP generation, giving the industry an open alternative to proprietary token systems and enabling interoperable hardware and software authenticators.

  57. 2006

    CERT C secure coding standard work begins

    The idea arose at the C Standards Committee meeting in Berlin. The project targeted actionable security guidance for C programmers.

  58. 2006

    CWE receives its first release

    The first Common Weakness Enumeration list established community definitions and classifications for recurring software weaknesses.

  59. 2006

    NIST created the SCAP program

    SCAP began as a program to standardize machine-readable security configuration and vulnerability information. This moved configuration assessment toward interoperable automation.

  60. 2006

    NIST SP 800-100 published

    NIST published Information Security Handbook: A Guide for Managers. It connected information-security program governance with management roles, controls, and performance measures.

  61. 2006

    SDL is released for wider adoption

    Microsoft records 2006 through 2008 as the period when the SDL was released publicly and threat-modeling tooling collaboration expanded. This positioned design analysis as a reusable industry practice.

  62. 2006 Apr

    Sender Policy Framework published as RFC 4408

    Domain owners gained a standardized way to identify hosts authorized to send mail for an envelope domain. This added a delivery-layer check against some spoofed mail.

  63. 2006 Apr

    SPF is published as RFC 4408

    SPF documented DNS-published authorization of SMTP senders. It made the envelope sender identity an operational authorization target.

  64. 2006 Apr

    TLS 1.1 published as RFC 4346

    Added explicit per-record initialization vectors for CBC cipher suites, addressing the chosen-plaintext weakness that the BEAST attack later demonstrated against TLS 1.0 in practice.

  65. 2006 May

    Upstream blocks are added

    Upstream blocks made backend groups a first-class configuration concept. Proxy policy now needed to include backend selection, timeout behavior, and later TLS peer verification.

  66. 2006 Jun

    RFC 4510–4519 replace the earlier LDAPv3 specification

    The revised document set separated the protocol, information models, security, names, filters, URLs, syntaxes, matching, and user schema.

  67. 2006 Aug 24

    Amazon EC2 enters public beta

    Self-service compute became available to anyone with a credit card, minutes after signup. The operating split between a provider that runs the hardware and a customer that runs everything above it arrived before any shared framework described who owned which control.

  68. 2006 Sep

    NIST publishes enterprise log-management guidance

    NIST SP 800-92 described log-management infrastructure, planning, and operational processes across an enterprise. Logging became an explicit program that supported analysis and incident handling rather than a collection of isolated files.

  69. 2006 Sep

    NIST publishes SP 800-92

    NIST published enterprise guidance for computer security log management. The guide described centralized infrastructures and identified SIEM as a class of analysis-focused logging software.

  70. 2006 Oct

    NIST SP 800-100 focuses on security program managers

    The handbook assembled program elements for managers establishing and implementing an information security program.

  72. 2007

    NIST SP 800-100 final update

    NIST issued the final update to SP 800-100. Its handbook framing kept governance and management distinct from operational security work.

  73. 2007 Feb

    NIST SP 800-94 defines the broader IDPS field

    NIST replaced its IDS guide with guidance covering detection and prevention. It organized enterprise technology into network-based, wireless, network behavior analysis, and host-based classes.

  74. 2007 May

    DKIM is specified in RFC 4871

    DKIM standardized domain-associated message signatures. Receivers could validate a signing domain independently of the SMTP path.

  75. 2007 May

    DomainKeys Identified Mail published as RFC 4871

    DKIM standardized domain signatures over email content so receivers could verify responsibility for a message. The specification identified phishing control as one intended benefit.

  76. 2007 May

    Jericho Forum Commandments version 1.2 published

    The commandments documented design principles for systems operating beyond a fixed perimeter. They connected open networks with data protection, identity, trust, and policy enforcement.

  78. 2007 Nov

    Metadata extensions cover additional requester roles

    OASIS approved metadata extensions for standalone query requesters and a profile for describing SAML 1.x entities with SAML 2.0 metadata.

  79. 2007 Nov

    Symantec acquires Vontu for 350 million dollars

    Symantec announced the purchase of Vontu for 350 million dollars and completed it at the end of the month. The deal moved DLP from a niche category into the portfolios of mainstream enterprise security vendors.

  81. 2008

    Fine-grained password policy is introduced

    Windows Server 2008 introduced fine-grained password and account-lockout policies. Administrators could apply different password controls to users and groups within one domain.

  82. 2008

    Microsoft publishes the SDL approach

    Microsoft published its Security Development Lifecycle approach for security and privacy considerations across development phases. The approach became a public reference for formal lifecycle practice.

  83. 2008

    Microsoft SDL released publicly

    Microsoft moved its internal lifecycle practices into publicly available guidance and tools for wider secure-development adoption.

  84. 2008 Mar

    X.509 deployment profiles are approved

    New profiles specified attribute exchange and SAML subject representation for systems that authenticate principals with X.509 certificates.

  86. 2008 May

    IETF publishes RFC 6238 (TOTP)

    The Time-Based One-Time Password standard builds on HOTP with a time source, enabling the authenticator apps and software tokens that make MFA accessible beyond organizations that can issue hardware.

  87. 2008 May

    RFC 5280 becomes the current Internet PKIX certificate and CRL profile

    RFC 5280 obsoleted earlier PKIX profiles and specified X.509 version three certificate, CRL, and path-validation processing for Internet use.

  88. 2008 May

    RFC 5280 becomes the PKIX certificate and CRL profile

    RFC 5280 replaced RFC 3280 and specified the certificate and CRL profile used for Internet PKI path validation. Its extension and constraint rules remain a reference for certificate-chain handling.

  89. 2008 Jul

    NIST published the Guide to General Server Security

    NIST SP 800-123 organized server hardening around selecting, implementing, and maintaining security controls. The guidance framed secure configuration as lifecycle work rather than initial setup alone.

  90. 2008 Jul

    NIST SP 800-55 Revision 1 published

    Revision 1 updated performance-measurement guidance and linked measures to resource allocation and reporting.

  91. 2008 Aug

    McAfee completes its Reconnex acquisition

    McAfee closed its 46 million dollar acquisition of Reconnex, a network DLP and data-at-rest discovery vendor, and folded the technology into ePolicy Orchestrator. Consolidation ran in parallel, with EMC buying Tablus and Websense buying PortAuthority.

  92. 2008 Aug

    TLS 1.2 published as RFC 5246

    Replaced hardcoded hash functions with cipher-suite-specified pseudo-random functions and added AEAD modes such as AES-GCM. TLS 1.2 remains the compatibility floor for current deployment guidance.

  94. 2008 Oct

    First official CERT C standard released

    SEI published the first official CERT C Secure Coding Standard, with rules, insecure examples, and secure alternatives for recurring C coding errors.

  95. 2009

    Active Directory Recycle Bin arrives in Windows Server 2008 R2

    Active Directory Recycle Bin made deleted objects recoverable without restoring a backup or restarting directory services. It improved object recovery but did not replace forest recovery after compromise.

  96. 2009

    Cloud Security Alliance forms and publishes its first guidance

    The CSA incorporated and released Security Guidance for Critical Areas of Focus in Cloud Computing, the first broad attempt to name the customer-side controls that a provider contract does not cover.

  97. 2009

    First devopsdays held in Ghent

    The first devopsdays conference brought software development and operations together as one technical conversation.

  98. 2009

    Privacy by Design principles published

    Ontario's Privacy by Design framework set out seven foundational principles, including proactive design and privacy as the default setting. It helped frame privacy as something built into systems and business practices.

  99. 2009

    SDL collaboration expands beyond Microsoft

    Microsoft's SDL timeline records collaboration with SAFECode, Adobe, Cisco, DISA, and NIST from 2009 through 2011. Threat modeling became part of wider secure-development guidance and exchange.

  102. 2009 Mar

    RFC 5424 standardizes the syslog protocol

    RFC 5424 replaced RFC 3164 with a standards-track, transport-independent protocol and structured data model. It made event format, timestamps, extensions, and transport mappings more explicit.

  103. 2009 Apr

    Directions in Security Metrics Research published

    NIST published research directions that treated security measurement as a continuing technical and organizational problem.

  104. 2009 Aug

    Metadata Interoperability Profile reaches Committee Specification

    The profile defined rules for metadata producers and consumers to provision federation relationships consistently and derive trust processing from metadata.

  105. 2009 Aug

    NIST SP 800-53 Revision 3 expands the control catalog

    Revision 3 delivered a major update to security controls for federal systems and organizations. Its catalog supported consistent requirements while remaining complementary to other standards.

  106. 2009 Aug

    NIST SP 800-53 Revision 3 published

    Revision 3 extended the catalog to federal information systems and organizations. Identity governance could be framed as organization-wide control work rather than a single application setting.

  107. 2009 Sep

    NIST publishes revised firewall policy guidance

    NIST SP 800-41 Rev. 1 updated its firewall guidance with policy, selection, configuration, testing, deployment, and management considerations. Firewall operation became a lifecycle concern rather than only a perimeter-device purchase.

  108. 2009 Sep 28

    NIST publishes SP 800-41 Rev. 1

    The revision expanded guidance across network and host-based firewall technologies, placement, policy, testing, deployment, and management.

  109. 2009 Nov

    SCAP version 1.0 was specified

    NIST SP 800-126 defined the first SCAP version as a suite of specifications for standardized security-software communication. Assessment products could exchange configuration and vulnerability information in defined formats.

2010s

182 milestones

  1. 2010

    CSA publishes the Cloud Controls Matrix

    The first control framework written specifically for cloud services, mapping each control to the party responsible for it and to existing standards. It made the shared-responsibility split auditable rather than rhetorical.

  2. 2010

    Cuckoo Sandbox begins as a Honeynet Project effort

    Cuckoo established an open architecture for launching samples in isolated guests and collecting process, file, memory, screenshot, and network evidence.

  4. 2010 Feb

    Risk Management Framework replaces certification focus

    SP 800-37 Revision 1 described a six-step lifecycle with control selection, assessment, authorization, and ongoing monitoring.

  5. 2010 Mar

    OISF forms and Suricata 1.0 is released

    The Open Information Security Foundation launched alongside the first Suricata release. Practitioners gained another open engine designed for network detection, prevention, and monitoring.

  6. 2010 Apr

    OAuth 1.0 is published as an RFC

    RFC 5849 published OAuth 1.0. It documented a signed-request approach to delegated access before OAuth 2.0 replaced it.

  7. 2010 Apr

    SSAE 16 announced to replace SAS 70

    The AICPA moved service-organization reporting from an auditing standard (SAS 70) to an attestation standard (SSAE 16), aligning more closely with international assurance practice.

  8. 2010 May

    NIST SP 800-34 Revision 1 published

    NIST updated federal contingency planning guidance with risk management and system development life cycle considerations. This reinforced that recovery requires planning for systems and operations, not only backups.

  9. 2010 Jun

    NIST SP 800-53A Revision 1 published

    The assessment guide described procedures for evaluating security controls. This strengthened the distinction between recording an access decision and obtaining evidence that a control operates.

  10. 2010 Jul

    DNSSEC is deployed in the DNS root zone

    The root-zone deployment made cryptographic trust anchors available from the top of the DNS hierarchy. It made authenticated DNS responses a practical part of the internet's security architecture.

  11. 2010 Jul

    NIST published the SCAP adoption guide

    NIST SP 800-117 explained how organizations and vendors could use SCAP-enabled tools. The publication connected the specification to baseline verification, monitoring, and security measurement.

  12. 2010 Aug

    Forrester presents the Zero Trust model

    John Kindervag's webinar named a zero-trust model that treated all users as untrusted and placed security throughout the network rather than only at its edge.

  13. 2010 Oct 1

    KMIP Version 1.0 becomes an OASIS Standard

    KMIP defined a common client-server protocol and profiles for managing cryptographic objects across products that had used incompatible interfaces.

  14. 2010 Nov

    Identity Assurance Profiles are approved

    The profiles standardized ways to express authentication assurance information and an IdP's assurance certification in metadata.

  15. 2011

    Intelligence-Driven Defense describes the Cyber Kill Chain

    The paper presented intrusion analysis as a sequence of adversary actions and defense opportunities. It gave defenders a behavior-oriented way to organize investigation before the modern hunting vocabulary was common.

  17. 2011 Apr 12

    NGINX 1.0 stable release

    NGINX 1.0 established the first stable release line. Version tracking and advisory review became a clearer operational control for deployed installations.

  18. 2011 May

    AWS IAM launches as a Generally Available service

    Every AWS account gains an integrated service for creating users, groups, and JSON-based identity-based and resource-based policies, replacing the previous model where every API call used root credentials.

  19. 2011 Jun 15

    SSAE 16 effective for period ends

    SSAE 16 became required for service organization reports with periods ending on or after June 15, 2011, ending SAS 70 as the governing standard for new reporting periods.

  20. 2011 Sep

    BEAST attack demonstrated against TLS 1.0

    Rizzo and Duong showed a practical chosen-plaintext attack against TLS 1.0 CBC mode that could recover HTTPS session cookies. The attack validated the per-record IV fix in TLS 1.1 and accelerated the case for TLS 1.2 adoption.

  21. 2011 Sep

    NIST formalizes information security continuous monitoring

    NIST SP 800-137 defined an organization-wide strategy for ongoing visibility into assets, threats, vulnerabilities, and control effectiveness. Monitoring outputs were tied directly to risk decisions and risk tolerance.

  22. 2011 Sep

    NIST SP 800-137 established continuous monitoring guidance

    The guide connected ongoing visibility into assets, threats, vulnerabilities, and control effectiveness with organizational risk tolerance.

  23. 2011 Nov

    Cross-account access via IAM Roles

    Users and services in one AWS account can assume a role in another account through sts:AssumeRole, enabling delegated administration and the multi-account patterns that underpin modern landing zones.

  24. 2011 Dec

    ISO/IEC 29100 privacy framework published

    ISO/IEC 29100 provided a privacy framework and privacy principles for personally identifiable information processing. It supplied a standards-oriented reference for integrating privacy into information and communication technology systems.

  25. 2011 Dec

    NIST publishes SP 800-144 on public cloud security and privacy

    Government guidance set out the governance, compliance, trust, architecture, identity, data-protection, and incident-response questions an organization has to answer before moving data or workloads to a public cloud.

  26. 2012

    Recycle Bin management moves into Active Directory Administrative Center

    Windows Server 2012 added a graphical interface for enabling, locating, and restoring deleted objects. Recovery operations became more accessible while retaining the same underlying directory controls.

  27. 2012 Jan

    NIST SP 800-162 defined ABAC considerations

    NIST described attribute-based access control and the attributes used in policy decisions. This made authoritative identity attributes a more explicit input to access decisions.

  28. 2012 Feb

    NIST publishes WLAN security guidance

    NIST SP 800-153 consolidated recommendations for securing wireless clients, access points, switches, and monitoring throughout the WLAN lifecycle. Wireless security became an operational design and monitoring concern, not only a passphrase choice.

  29. 2012 Feb 11

    BIP-32 (Hierarchical Deterministic Wallets) created

    The proposal standardized deriving a full tree of keys from one seed, replacing the practice of generating and separately backing up an independent key for every address.

  30. 2012 Mar

    FTC privacy report calls for privacy by design

    The FTC's final report made privacy by design, simplified choice, and greater transparency central recommendations. It connected privacy expectations to product development and data practices.

  31. 2012 Aug

    NIST SP 800-61 Revision 2 published

    NIST revised its Computer Security Incident Handling Guide to address evolving threats and incident response competencies. The guide linked preparation, detection, analysis, containment, recovery, and lessons learned into incident handling practice.

  32. 2012 Sep

    CSA launches the STAR registry

    The Security, Trust, Assurance and Risk registry let providers publish their control self-assessments in a common format, so customers could compare provider claims instead of taking each vendor's word separately.

  33. 2012 Oct

    OAuth 2.0 authorization framework is published

    RFC 6749 standardized OAuth 2.0 authorization grants and access tokens. API security practice gained a common framework for delegated authorization.

  35. 2013

    Exchange Server 2013 ships built-in DLP policies

    Microsoft added DLP policy templates, transport-rule conditions, and policy tips to Exchange Server 2013. Content inspection for email moved into the mail server itself rather than a separate appliance or gateway.

  36. 2013

    FBI began tracking business email compromise

    The FBI began tracking a financial fraud pattern that combined social engineering, spoofing, compromised communications, and payment authority. Defense practice increasingly had to verify business transactions, not only inspect message appearance.

  37. 2013

    MITRE starts ATT&CK

    MITRE began ATT&CK to document adversary tactics, techniques, and procedures for research on endpoint telemetry and post-compromise analytics. Security operations teams gained a shared behavior model for detection and assessment.

  38. 2013

    NGINX Plus is released

    NGINX Plus added a commercial product path focused on traffic management, dynamic configuration, and monitoring. Deployments now needed to inventory the edition and its exposed management capabilities as well as the core server configuration.

  39. 2013

    Protected Users appears with Windows Server 2012 R2

    Protected Users added nonconfigurable restrictions on NTLM, weak Kerberos encryption, delegation, and ticket renewal for its members. It made credential-hardening compatibility a deployment concern.

  40. 2013 Feb

    Executive Order 13636 directs a cybersecurity framework

    The order directed development of a voluntary, risk-based framework for critical infrastructure cybersecurity. It created the policy origin for the NIST Cybersecurity Framework.

  41. 2013 Feb

    FIDO Alliance founded

    A consortium including PayPal, Lenovo, and Nok Nok Labs forms to develop open authentication standards. The alliance later adds Apple, Google, and Microsoft, and its specifications become the foundation for phishing-resistant MFA.

  42. 2013 Apr

    NIST SP 800-53 Revision 4 published

    Revision 4 integrated privacy controls with security controls. Governance programs could relate identity and access evidence to a broader security and privacy control catalog.

  43. 2013 Jun

    RFC 6960 updates OCSP

    RFC 6960 updated the Online Certificate Status Protocol. It defined signed status responses for certificate serial numbers, reinforcing that revocation status is evaluated by relying parties under local policy.

  44. 2013 Jun

    RFC 6962 specifies Certificate Transparency

    The experimental RFC defined public logs and cryptographic proofs for observing TLS certificate issuance. Domain owners and clients gained a mechanism for detecting publicly logged certificates.

  45. 2013 Aug

    Enhanced Client or Proxy Profile Version 2.0 is approved

    The updated HTTP profile added Holder of Key subject confirmation and channel-binding support for capable clients that contact identity providers directly.

  46. 2013 Sep

    CryptoLocker begins the modern ransomware campaign model

    CryptoLocker paired malware distribution with encryption and a payment workflow. The Canadian Centre for Cyber Security identifies it as the first modern ransomware campaign.

  47. 2013 Sep 10

    BIP-39 (mnemonic seed phrases) created

    The proposal standardized converting wallet entropy into a checksummed, human-readable word sequence, turning the single backup an HD wallet needs into something a person can write down and read back correctly.

  48. 2013 Nov 13

    AWS announces CloudTrail

    Account-level recording of API calls became a standard cloud capability. Every administrative change now left an entry naming the identity, the action, the source address, and the result, which is the evidence an investigation depends on.

  49. 2014

    Automated ransomware campaigns proliferate

    The CryptoLocker model spread through malicious attachments and broad campaigns from 2014 through 2016. Defense therefore needed to cover access paths and endpoints at scale.

  50. 2014

    CWE adds mobile application content

    CWE expanded its weakness classifications with content for mobile applications as software platforms and attack surfaces changed.

  51. 2014

    Google publishes the first BeyondCorp architecture paper

    Google described removing the privileged intranet and making access depend on users and devices. The paper supplied a production example of resource access without location-based trust.

  52. 2014 Jan 19

    Linux 3.13 includes nftables

    The Linux kernel added nftables as the successor to iptables, using a flexible ruleset representation and a new userspace interface.

  53. 2014 Feb

    NIST Cybersecurity Framework 1.0 organizes security outcomes

    The framework gave organizations a common risk-based structure around Identify, Protect, Detect, Respond, and Recover rather than prescribing one control implementation.

  56. 2014 Feb

    OpenID Connect 1.0 is launched

    The OpenID Foundation ratified an authentication layer on OAuth 2.0 for websites and applications. JSON-based ID Tokens and discovery gave modern clients another interoperable SSO path.

  57. 2014 Feb

    OpenID Connect Core 1.0 finalized

    OpenID Connect added an interoperable identity layer to OAuth 2.0, including the ID Token and standardized identity claims for relying parties.

  58. 2014 Feb 12

    NIST Cybersecurity Framework 1.0 released

    NIST released a voluntary framework for improving critical infrastructure cybersecurity. Its five functions gave organizations a common structure for managing cybersecurity risk.

  59. 2014 Feb 12

    NIST releases Cybersecurity Framework 1.0

    The framework introduced a common risk language built around the Identify, Protect, Detect, Respond, and Recover functions. Profiles connected those outcomes to organizational needs without prescribing one implementation.

  60. 2014 Feb 26

    OpenID Connect ratified

    The OpenID Foundation ratified an identity layer over OAuth 2.0. ID Tokens, claims, issuer identifiers, and relying-party validation enabled interoperable web sign-in with JSON-based artifacts.

  61. 2014 Feb 28

    Mt. Gox files for bankruptcy; 850,000 BTC reported missing

    The exchange's collapse made a single custodian's internal key-management failure concrete at scale, years before "not your keys, not your coins" became common practitioner advice.

  62. 2014 Apr

    Heartbleed identifies a widely deployed OpenSSL flaw

    CVE-2014-0160 documented a memory-disclosure flaw in affected OpenSSL TLS and DTLS implementations. The event made rapid identification of deployed component versions an operational security need.

  63. 2014 Apr

    SPF is updated by RFC 7208

    RFC 7208 replaced RFC 4408 and clarified SPF evaluation and deployment. SPF remained evidence about SMTP identities rather than visible From identity.

  64. 2014 Apr 7

    Heartbleed disclosed

    A flaw in OpenSSL exposed memory from systems using affected releases. The event drew attention to the dependence of major services on critical open source components.

  65. 2014 Apr 24

    BIP-44 (multi-account hierarchy) assigned

    The proposal fixed the derivation path structure almost every HD wallet still uses, letting one seed manage multiple accounts across multiple chains without key collisions.

  66. 2014 Apr 24

    Core Infrastructure Initiative announced

    The Linux Foundation formed an industry-backed effort to identify and fund critical open source projects after Heartbleed.

  67. 2014 Jun

    Kubernetes is announced

    Google publicly introduced Kubernetes, bringing a shared orchestration model into the emerging cloud native ecosystem.

  68. 2014 Jun 9

    Docker Engine 1.0 reaches production support

    Docker Engine 1.0 was released with production support. Container images became a common application delivery artifact, making their contents and distribution a practical security concern.

  69. 2014 Jul 29

    Trezor One ships as the first dedicated hardware wallet

    SatoshiLabs' device moved private key generation and signing into a dedicated offline unit, establishing hardware-backed self-custody as a distinct, purchasable custody model.

  71. 2014 Sep

    Post-1.0 roadmap targets SAML integration

    Maintainers listed SAML 2.0 via PicketLink IDP merger work and additional application-server adapters as the next integration priorities.

  73. 2014 Oct

    POODLE attack disclosed against SSL 3.0

    Google researchers demonstrated a padding oracle attack against SSL 3.0 CBC mode. All major browsers disabled SSL 3.0 within weeks, effectively ending support for any protocol version below TLS 1.0.

  74. 2014 Dec

    FIDO Alliance ratifies U2F specification

    The Universal Second Factor specification defines a browser-based protocol for using external authenticators like security keys as a second factor. Google and GitHub begin supporting it, demonstrating phishing-resistant authentication in production.

  75. 2015

    Microsoft LAPS becomes available

    Microsoft LAPS provided a way to rotate distinct local administrator passwords and store them in Active Directory. It addressed the shared-local-password path used for lateral movement.

  76. 2015 Mar

    DMARC is specified in RFC 7489

    DMARC combined SPF and DKIM results with visible From alignment, published policy, and reporting. Domain owners gained a feedback loop for mail using their domains.

  77. 2015 Mar

    DMARC published as RFC 7489

    DMARC connected SPF and DKIM results to the visible sender domain, domain policy, and feedback reports. Domain owners gained a coordinated deployment and monitoring mechanism for spoofing defense.

  78. 2015 Apr

    Office 365 DLP extends to SharePoint Online and OneDrive

    Microsoft began previewing DLP for SharePoint Online and OneDrive for Business, adding policy evaluation to cloud content stores. Enforcement started to follow data into hosted repositories, not just mail flow.

  79. 2015 Apr

    OpenID Connect provider certification launches

    The OpenID Foundation introduced conformance profiles and tests for OpenID Providers. Operators gained public implementation evidence beyond a vendor's statement of protocol support.

  80. 2015 Apr

    TLS Fallback SCSV standardized as RFC 7507

    Defined a signaling cipher suite value that prevents protocol downgrade attacks by letting a server detect when a client has fallen back to a lower TLS version than the server supports.

  81. 2015 May

    JSON Web Token is standardized

    RFC 7519 defined JSON Web Token claims and compact serialization. Token validation became an explicit API implementation concern.

  82. 2015 Jun 22

    Open Container Project is announced

    Industry participants announced the Open Container Project to establish open container format and runtime standards. Docker contributed container format and runtime technology to the project.

  83. 2015 Jul

    Kubernetes 1.0 is released

    The 1.0 release marked an early production milestone for Kubernetes and made platform controls a practical concern for more teams.

  84. 2015 Jul

    The Open Container Initiative publishes its draft charter

    OCI began work on common container standards. The effort created a shared container-artifact model on which digest-addressed distribution and later signing workflows could converge.

  85. 2015 Aug 11

    Docker Engine 1.8 adds trusted pull, push, and build

    Docker Engine 1.8 introduced trusted pull, push, and build as an opt-in feature. Image integrity and publisher verification became explicit workflow concerns.

  86. 2015 Sep

    DLP rolls out in OneDrive, SharePoint Online, and Office 2016

    Microsoft began the general rollout of DLP across OneDrive for Business, SharePoint Online, and the Office 2016 desktop apps. Policy tips inside the editing applications brought data-in-use feedback to end users.

  87. 2015 Sep

    PKCE extends OAuth authorization code flow

    RFC 7636 specified proof key for code exchange. Public clients gained a standardized mitigation for authorization-code interception.

  88. 2015 Sep

    PKCE published as RFC 7636

    PKCE bound an authorization-code exchange to the client that began it, strengthening public-client and browser-mediated code flows.

  90. 2015 Sep 14

    Let's Encrypt begins publicly trusted certificate issuance

    Let's Encrypt placed its first publicly trusted certificate into service using automated software. Public certificate issuance became accessible through an automation-centered CA model.

  91. 2015 Sep 22

    HTTP/2 support reaches NGINX Open Source

    nginx 1.9.5 added the HTTP/2 module in place of the SPDY module. Protocol support changed request concurrency and expanded the protocol behavior that edge testing needed to cover.

  93. 2016

    BeyondCorp design-to-deployment account published

    Google documented deployment experience with dynamic device trust tiers. Zero trust moved from a high-level perimeter critique toward an operated access model.

  94. 2016

    NIST publishes draft data-centric threat-modeling guidance

    NIST SP 800-154 described data-centric system threat modeling as a form of risk assessment. It framed the practice around selected data and its attack and defense sides.

  95. 2016 Feb

    SANS publishes an early threat hunting model

    The paper defined hunting as a focused, iterative search for adversaries already inside an organization. It framed hypothesis generation and dedicated analysts as parts of the practice.

  96. 2016 Feb 4

    Docker Engine 1.10 adopts content-addressable image storage

    Docker Engine 1.10 introduced content-addressable storage for images and layers. Digest-based identity became central to selecting exact image content.

  97. 2016 Feb 9

    Dynamic modules are introduced

    nginx 1.9.11 introduced dynamic modules. Module inventory became more important because the active capability set no longer had to be fixed solely at compile time.

  98. 2016 Feb 29

    CIS publishes the AWS Foundations Benchmark v1.0.0

    A consensus configuration baseline for a cloud provider, covering logging, identity, and network settings. It became the default first yardstick for whether an account was set up safely, and the check set most posture tools shipped with.

  99. 2016 Mar

    Kubernetes joins CNCF

    Kubernetes entered CNCF as an incubating project, anchoring a wider cloud native project ecosystem.

  101. 2016 Apr

    GDPR adopted with design and default duties

    The GDPR was adopted with Article 25 requiring data protection by design and by default. It made technical and organizational measures part of the legal expectation for processing systems.

  102. 2016 Apr

    NIST IR 8105 defines the migration problem

    NIST summarized the quantum threat, defined the goal of PQC, and emphasized cryptographic agility and infrastructure migration.

  103. 2016 Apr

    SSAE 18 issued (clarification and recodification)

    The Auditing Standards Board issued SSAE No. 18, clarifying and recodifying attestation standards into AT-C sections for examinations such as SOC engagements.

  104. 2016 May 3

    CII Best Practices Badge launched

    The initiative introduced a badge program that lets projects document security and quality practices against public criteria.

  105. 2016 Oct

    in-toto launches

    The in-toto project introduced a framework for securing the software supply chain with signed metadata. It broadened the focus from signing a final artifact to verifying authorized steps and their materials and products.

  106. 2016 Oct 4

    Red Hat SSO product builds on Keycloak

    Red Hat described Red Hat SSO as its supported SAML and OAuth identity product built on upstream Keycloak, replacing earlier PicketLink-based custom IdP work for customer-facing login.

  107. 2016 Nov

    NIST SP 800-160 integrates security with systems engineering

    The publication applied security concepts and principles across standards-based systems engineering processes and the system life cycle.

  108. 2016 Dec

    NIST issues its call for proposals

    The call opened a public evaluation process for quantum-resistant public-key encryption, key-establishment, and signature algorithms.

  109. 2017

    2017 Trust Services Criteria published

    The AICPA Assurance Services Executive Committee issued the 2017 Trust Services Criteria, renaming the former principles framing, aligning structure with COSO 2013, and strengthening cybersecurity-oriented supplemental criteria used in SOC 2.

  110. 2017

    FLARE-VM packages a Windows reverse-engineering workstation

    The project encoded a repeatable collection of Windows analysis tools and environment configuration for installation inside a virtual machine.

  111. 2017

    Gartner publishes its last Enterprise DLP Magic Quadrant

    Gartner issued its final Magic Quadrant for Enterprise Data Loss Prevention and replaced it the next year with a Market Guide. The change reflected a market Gartner viewed as mature and increasingly delivered inside email, endpoint, and cloud-access platforms.

  112. 2017

    SANS publishes its threat hunting survey

    The survey documented how practitioners described and organized threat hunting. It made the emerging practice measurable enough to compare approaches and maturity.

  113. 2017

    Sigma introduces portable log detections

    Sigma introduced a shared rule format, tools, and collections for describing log detections across analysis platforms. Detection content could be reviewed and translated without beginning in one vendor's query language.

  114. 2017

    SLIP-39 (Shamir Backup) published

    SatoshiLabs published a standard for splitting a seed into a threshold of shares using Shamir's secret sharing, giving self-custody a documented alternative to a single written seed phrase.

  115. 2017 Jan

    Sigma repository begins portable log detections

    The Sigma project began publishing a generic format for describing log detections. Detection authors gained a shared representation that tooling could translate for different SIEM backends.

  116. 2017 Feb

    Service Control Policies arrive with AWS Organizations

    SCPs set organization-level permission guardrails for IAM users and roles in member accounts. They do not grant permissions; they cap the maximum available permissions.

  118. 2017 Apr

    RBAC reaches beta in Kubernetes 1.6

    The RBAC authorizer moved to beta and began to be enabled by default by common provisioning tools. It offered a migration path away from ABAC, whose policies were files on the API server that required a restart to change.

  119. 2017 May

    npm version 5 makes package lockfiles the default

    npm version 5 introduced package-lock.json as a standardized lockfile feature and made lockfiles the default. Repeatable resolution became normal evidence for reviewing a JavaScript dependency graph.

  120. 2017 May

    WannaCry spreads across organizations worldwide

    WannaCry remotely compromised systems, encrypted files, and affected organizations in more than 150 countries. It made patching and network exposure central ransomware-resilience concerns.

  121. 2017 May 1

    SSAE 18 effective for report dates

    SSAE 18 became effective for practitioners' reports dated on or after May 1, 2017, becoming the attestation framework for SOC 1, SOC 2, and SOC 3 examinations.

  122. 2017 Jun

    NIST SP 800-63-3 published

    NIST updated its digital identity guidelines. It clarified identity proofing, authentication, and federation as distinct concerns that IGA must coordinate with rather than replace.

  123. 2017 Jun

    NotPetya demonstrates destructive disruption at scale

    NotPetya exploited vulnerabilities, gained privileged rights, and rendered infected Windows computers unusable. The event reinforced that recovery planning must address essential systems, not only user files.

  124. 2017 Jun 22

    NIST finalized Digital Identity Guidelines Revision 3

    NIST reorganized federal digital-identity guidance around identity proofing, authentication, and federation. The authenticator guidance formalized verifier-impersonation resistance as a design property.

  125. 2017 Jun 22

    NIST publishes SP 800-12 Revision 1

    The revision updated the introductory handbook and connected information security principles to modern risk management and control families. It superseded the 1995 edition.

  126. 2017 Jul

    OCI releases version 1.0 container standards

    OCI released version 1.0 of its runtime and image-format specifications. A vendor-neutral image format made digest-addressed container artifacts a shared verification subject.

  127. 2017 Aug

    OpenID Connect relying-party certification reaches general availability

    Certification expanded from providers to relying parties. Application-side validation and session behavior could now be tested against published conformance profiles.

  129. 2017 Sep

    NISTIR 8062 defines privacy engineering objectives

    NISTIR 8062 introduced predictability, manageability, and disassociability together with a privacy-risk model based on problematic data actions. It gave engineers a way to translate privacy concerns into system objectives.

  130. 2017 Oct

    RBAC goes generally available in Kubernetes 1.8

    RBAC graduated to stable, fixing Roles, ClusterRoles, and their bindings as the authorization vocabulary. Cluster access design moved from provisioning-time configuration to ordinary API objects that could be reviewed and version-controlled.

  131. 2017 Nov

    OCI Image Specification 1.0.1 is released

    OCI released version 1.0.1 of the Image Specification. A stable format specification gave registries and tools a common model for manifests, configurations, and layers.

  132. 2017 Nov 6

    Parity multisig library self-destruct freezes roughly 280 million dollars in ether

    A reachable function let a user take ownership of, and then destroy, the shared library contract every affected Parity multisig wallet depended on, making the funds permanently unreachable without any key being stolen.

  133. 2017 Dec

    First round begins with 69 accepted candidates

    NIST began public review of 69 submissions that met its minimum acceptance and submission requirements.

  134. 2018

    2018 SOC 2 Description Criteria

    The AICPA issued description criteria for management's SOC 2 system description, separating description evaluation from control evaluation against the Trust Services Criteria.

  135. 2018

    Certificate Transparency enforcement begins

    Chrome required signed certificate timestamps for all publicly trusted certificates. Apple enforced CT for certificates issued after October 2018. Certificate issuance became auditable by design rather than by policy.

  136. 2018

    Practical threshold-ECDSA signing published (Gennaro and Goldfeder)

    Gennaro and Goldfeder's paper "Fast Multiparty Threshold ECDSA with Fast Trustless Setup" gave multi-party computation custody a signing protocol efficient enough for production wallets, ahead of the first commercial MPC custody providers.

  137. 2018 Jan

    ATT&CK v1.0 is preserved as a versioned release

    ATT&CK began a public version history with v1.0. Stable versions made it practical to record which technique vocabulary a hunt, analytic, or coverage review used.

  138. 2018 Jan

    NIST updates SP 800-160 design-principle guidance

    The update emphasized applying security design principles to critical infrastructure systems and corrected the first edition.

  139. 2018 Feb

    Bad Security Metrics research published

    NIST listed research on common measurement problems and solutions, reinforcing the need to distinguish activity counts from useful security measures.

  140. 2018 Feb

    SCAP version 1.3 was released

    NIST published SCAP 1.3 as the third revision after version 1.0. The revision continued the standardized assessment model while NIST documented coverage gaps for newer endpoint types.

  141. 2018 Mar

    Kubernetes becomes the first graduated CNCF project

    CNCF graduated Kubernetes after its incubation period, signaling the maturity of the platform around which many cloud native controls operate.

  143. 2018 Apr 16

    NIST Cybersecurity Framework 1.1 released

    NIST released version 1.1 with refinements for identity, supply-chain risk management, self-assessment, and coordinated vulnerability disclosure. It remained compatible with version 1.0.

  144. 2018 Apr 16

    NIST releases Cybersecurity Framework 1.1

    Version 1.1 added clearer treatment of self-assessment, identity, supply-chain risk, and vulnerability disclosure. Policy teams gained more explicit connections between organizational outcomes and changing dependencies.

  145. 2018 May

    GDPR becomes applicable

    The GDPR became applicable across the European Union. Privacy design decisions increasingly needed evidence across deployed systems, vendors, retention paths, and rights-request workflows.

  146. 2018 May 25

    GDPR becomes applicable

    The European Union's harmonized data-protection rules became applicable across personal-data processing in scope. Policy programs had to connect privacy obligations to internal rules, controls, and evidence across organizational boundaries.

  147. 2018 Jun

    OAuth authorization-server metadata published as RFC 8414

    The specification standardized metadata discovery for authorization servers, including endpoint and signing-related configuration used by clients and relying parties.

  148. 2018 Jul

    Permissions Boundaries launched

    A permissions boundary caps the maximum permissions that identity-based policies can grant to an IAM user or role, enabling delegated identity administration without unbounded privilege escalation.

  149. 2018 Aug

    TLS 1.3 published as RFC 8446

    Removed RSA key exchange, eliminated CBC ciphers, and reduced the handshake to one round trip. Mandatory forward secrecy and authenticated encryption became baseline properties rather than optional enhancements.

  150. 2018 Aug 28

    TLS 1.3 early-data control is added

    nginx 1.15.3 added the ssl_early_data directive when supported by OpenSSL. TLS hardening therefore continued to depend on the deployed NGINX and cryptographic-library combination rather than on a static configuration recipe.

  151. 2018 Sep

    MTA-STS is specified in RFC 8461

    MTA-STS defined a policy mechanism for requiring authenticated TLS when mail is delivered to a domain. It strengthened transport protection as a distinct email-security layer.

  152. 2018 Oct

    ATT&CK moves from MediaWiki to a versioned site and STIX/TAXII

    The update moved the older site aside and directed users to the newer site and STIX/TAXII data for current content. That made technique data easier to consume in tooling as well as in the browser.

  153. 2018 Oct

    The Bro project adopts the Zeek name

    Project leadership renamed Bro to Zeek while retaining its long-developed network analysis model. The change marked continuity of the monitoring platform and its community under a new name.

  154. 2018 Nov

    CVE-2018-1002105 exposes the API server proxy path

    A flaw in how kube-apiserver handled proxied upgrade requests let an authorized client send arbitrary requests to a backend using the API server's own TLS credentials, scoring 9.8 on CVSS v3. It was the first critical Kubernetes CVE to prompt broad emergency patching.

  155. 2018 Dec

    Risk Management Framework expands to organizations and privacy

    SP 800-37 Revision 2 added organization preparation, privacy integration, stronger accountability, and continuous monitoring across system and organization levels.

  156. 2019

    LockBit predecessor activity is first observed

    CISA records ABCD ransomware activity in September 2019 as the predecessor to LockBit. The operation's later affiliate model illustrated why defender observations vary across incidents.

  157. 2019

    OWASP publishes its first API Security Top 10

    OWASP released its first API-specific Top 10. It established a shared vocabulary for broken object authorization and resource limits.

  158. 2019 Jan

    in-toto releases its Jenkins plugin

    The first official in-toto Jenkins plugin recorded and signed link metadata for pipeline steps. This made signed supply-chain evidence available inside a common CI system.

  159. 2019 Jan

    Subject Identifier Attributes Profile is approved

    The profile introduced subject identifier attributes to replace inconsistent practices and address weaknesses in persistent NameID usage.

  160. 2019 Jan

    Twenty-six candidates advance to round two

    NIST narrowed the field and increased attention to performance across servers, phones, smart cards, embedded devices, and chips.

  162. 2019 Feb 5

    QuadrigaCX files for creditor protection

    The exchange's founder had sole control of customer keys and died without sharing access; a later forensic audit found several of the wallets believed to hold customer funds had already been empty for months.

  163. 2019 Mar

    ACME is standardized as RFC 8555

    The IETF standardized an interoperable protocol for certificate authorization, issuance, and revocation. Automated renewal could use a common workflow across compatible clients and authorities.

  164. 2019 Mar

    ACME protocol standardized as RFC 8555

    The Automatic Certificate Management Environment protocol behind Let's Encrypt reached IETF standard status. Fully automated issuance and renewal drove mass HTTPS adoption from roughly 45% to over 95% of web traffic.

  165. 2019 Mar

    RFC 8555 standardizes ACME

    RFC 8555 standardized ACME interactions for account registration, authorization, certificate orders, finalization, download, renewal, and revocation. It made repeatable issuance workflows a standard protocol concern.

  166. 2019 Mar

    W3C publishes WebAuthn Level 1 as a web standard

    The Web Authentication API becomes an official W3C Recommendation, enabling browsers and relying parties to use public-key credentials for authentication. This is the moment FIDO moves from a plugin model to a native browser capability.

  167. 2019 Mar 4

    WebAuthn became an official web standard

    W3C and the FIDO Alliance announced WebAuthn as a Recommendation and a core FIDO2 component. Web applications gained a standard route to public-key credentials bound to the legitimate verifier.

  168. 2019 Mar 4

    WebAuthn becomes a W3C Recommendation

    W3C and the FIDO Alliance finalized Web Authentication as a web standard for public-key credentials. Browsers and platforms gained a common API for phishing-resistant authenticator ceremonies.

  169. 2019 Mar 5

    NSA releases Ghidra publicly

    The public release provided a free, extensible reverse-engineering suite with disassembly, decompilation, scripting, and collaboration features.

  170. 2019 Mar 22

    FIPS 140-3 is approved

    FIPS 140-3 updated requirements for cryptographic module design, implementation, operation, sensitive-parameter management, and lifecycle assurance.

  171. 2019 Apr 4

    Ghidra source code is released

    Publishing the source enabled community inspection, patches, extensions, and builds across supported platforms.

  172. 2019 May

    ARC is specified in RFC 8617

    ARC standardized a way to preserve authentication assessments across intermediaries. It addressed evidence loss in forwarding and mailing-list paths without replacing DMARC.

  173. 2019 Jun

    Elastic SIEM launches with Elastic Stack 7.2

    Elastic introduced a dedicated SIEM application for host and network investigation workflows. It joined common-schema event data with a security-focused analyst interface.

  174. 2019 Jul

    The Capital One breach is disclosed

    A server-side request forgery flaw let an attacker reach the instance metadata service, read the attached role credentials, and use them to copy data on more than one hundred million people from storage. The case became the standard example of how one application bug plus a broad workload identity becomes a data breach.

  175. 2019 Aug

    CNCF publishes the first third-party Kubernetes security audit

    Trail of Bits and Atredis Partners assessed eight core components against Kubernetes 1.13.4 and reported 37 findings, alongside a whitepaper and attacker-oriented threat guide. Findings and documentation were released publicly rather than summarized.

  176. 2019 Sep

    NIST releases the initial SP 800-207 draft

    The draft defined logical components, deployment models, use cases, and a migration roadmap in technology-neutral language. Public review began a shared architecture vocabulary beyond individual vendor or enterprise designs.

  177. 2019 Oct

    Metadata Interoperability Profile becomes an OASIS Standard

    OASIS elevated the profile that makes metadata a self-contained source for endpoints, keys, and trust-processing requirements.

  178. 2019 Nov

    Broadcom acquires Symantec's enterprise security business

    Broadcom completed its 10.7 billion dollar purchase of Symantec's enterprise security business, including Symantec DLP. The former parent renamed itself NortonLifeLock and kept the consumer products.

  179. 2019 Nov

    Chronicle Backstory joins Google Cloud security

    Google described Backstory as its flagship hybrid security analytics offering while consolidating Chronicle into Google Cloud. The move placed large-scale security analytics inside a major cloud platform.

  180. 2019 Nov

    GitHub automated security updates become generally available

    GitHub made automated pull requests for nearest non-vulnerable dependency versions generally available for public repositories. Dependency remediation became part of routine pull-request work.

  181. 2019 Nov 19

    AWS releases IMDSv2

    The metadata service moved to session-authenticated requests with a low IP time-to-live and a request-header requirement, so a forwarded or proxied request can no longer retrieve instance role credentials. It is the direct control response to the previous attack class.

  182. 2019 Dec

    IAM Access Analyzer launched

    Uses automated reasoning to identify resources shared outside a defined zone of trust. Later extended with internal access analysis, unused access findings, policy validation, and policy generation.

2020s

137 milestones

  1. 2020

    CWE adds hardware weaknesses

    CWE extended the list beyond software weaknesses to cover recurring hardware security issues and their classifications.

  2. 2020

    LockBit appears as a ransomware-as-a-service operation

    LockBit-named ransomware was first seen on cybercrime forums in January 2020. The service model separated ransomware development from affiliate intrusion activity.

  3. 2020

    Sigstore project started

    Sigstore began work on accessible signing and transparency services for open source software artifacts.

  4. 2020

    Threat Modeling Manifesto is created

    A cross-practitioner group created the Threat Modeling Manifesto. It articulated shared values, principles, patterns, and anti-patterns for collaborative and continuous practice.

  5. 2020 Jan

    NIST Privacy Framework 1.0 released

    NIST released a voluntary privacy risk-management framework with a Core and Profiles. Teams could express current and target privacy outcomes and prioritize gaps in a form that fits enterprise risk management.

  9. 2020 Feb

    RFC 8737 adds IP identifier validation to ACME

    RFC 8737 extended ACME to validate IP address identifiers. It broadened automated certificate issuance beyond DNS identifiers for eligible deployments.

  10. 2020 Mar

    LDAP channel-binding support is introduced

    Microsoft added LDAP channel-binding support and audit events for insecure binds. Administrators could identify compatibility dependencies before hardening directory authentication.

  11. 2020 Mar 2

    MITRE ATT&CK created phishing technique T1566

    ATT&CK placed phishing under Initial Access and separated delivery through attachments, links, services, and later voice. Defenders gained a shared technique model for coverage and scenario design.

  14. 2020 May

    SP 800-57 Part 1 Revision 5 is published

    Revision 5 expanded treatment of key metadata, access control, identity authentication, inventory, certificates, and current cryptographic guidance.

  15. 2020 May

    SPIFFE and SPIRE reach 1.0

    The SPIFFE and SPIRE 1.0 release established a stable milestone for workload identity and identity issuance in dynamic environments.

  16. 2020 Jun

    Dependabot version updates add scheduled maintenance

    GitHub added scheduled Dependabot version updates alongside security updates. Maintaining dependency currency became distinct from responding to disclosed vulnerabilities.

  17. 2020 Jun

    NIST SP 800-137A published

    The assessment guide added a method for evaluating the effectiveness of an information security continuous-monitoring program.

  18. 2020 Jul

    ATT&CK v7 releases Enterprise sub-techniques

    The first non-beta Enterprise release with sub-techniques made technique descriptions more specific. Hunters could use a more precise behavior label when forming and documenting a hypothesis.

  19. 2020 Jul

    Fifteen candidates enter round three

    Seven finalists and eight alternates entered the selection round for deeper public security and performance review.

  20. 2020 Aug

    NIST publishes SP 800-207

    The final publication established zero trust tenets, policy engine, policy administrator, policy enforcement point, trust-algorithm inputs, threats, and deployment approaches as a reference architecture.

  21. 2020 Aug

    NIST publishes SP 800-207, Zero Trust Architecture

    The document defined zero trust for implementers: no access granted on network location alone, every request authenticated and authorized against the subject, device, resource, and context. It gave cloud teams a referenceable definition rather than a vendor slogan.

  22. 2020 Aug

    NIST publishes Zero Trust Architecture

    NIST SP 800-207 described zero trust as moving defenses from static network perimeters toward users, assets, and resources. It formalized the shift from location-based trust to explicit access decisions.

  23. 2020 Aug

    NIST SP 800-207 defines Zero Trust Architecture

    The guidance shifted access reasoning away from implicit network-location trust toward explicit decisions about users, devices, assets, and resources.

  24. 2020 Aug 3

    OpenSSF formed

    The Linux Foundation consolidated the Core Infrastructure Initiative, the Open Source Security Coalition, and other efforts into the OpenSSF.

  25. 2020 Aug 11

    NIST publishes Zero Trust Architecture

    NIST SP 800-207 narrowed defenses from broad network perimeters toward resources and removed implicit trust based only on network location. Firewalls remained enforcement points within a wider policy architecture.

  26. 2020 Sep

    Microsoft announces Endpoint DLP at Ignite

    Microsoft added native endpoint enforcement to Microsoft 365 DLP, covering USB copy, network shares, cloud uploads, printing, and clipboard on Windows 10 without a separate agent. Endpoint coverage became part of the same policy set as email and SharePoint.

  27. 2020 Sep

    NIST publishes SP 800-53 Revision 5

    Revision 5 consolidated security and privacy controls for systems and organizations and emphasized flexible, customizable use. Official OSCAL formats and crosswalks strengthened machine-readable reuse while preserving mapping limits.

  28. 2020 Sep

    NIST SP 800-53 Revision 5 published

    Revision 5 consolidated security and privacy controls and made control statements outcome-based. IGA programs could align ownership, access review, and evidence with a broader organization-level control framework.

  29. 2020 Sep 23

    NIST SP 800-53 Revision 5 published

    NIST integrated security and privacy controls into one catalog and added a supply-chain risk management control family. The revision broadened control selection beyond isolated technical safeguards.

  30. 2020 Oct

    ATT&CK v8 adds reconnaissance and resource development to Enterprise

    The release retired the separate PRE-ATT&CK domain and added reconnaissance and resource development tactics to Enterprise ATT&CK. This expanded the behavior model around activity that precedes access to an environment.

  31. 2020 Oct

    NIST IR 8286 connects cyber risk with enterprise risk

    The publication used risk registers and shared business language to bring cybersecurity risk into enterprise risk management.

  32. 2020 Nov

    NIST IR 8286 connects cyber risk registers to ERM

    NIST described how cybersecurity risk registers can communicate system and organizational risks into enterprise risk management. The guidance made risk aggregation a governance concern rather than a system-by-system activity.

  33. 2021 Apr

    ATT&CK v9.0 begins a new major release

    The version history records v9.0 as the next major ATT&CK release. Continuing versioned updates kept the behavior vocabulary that hunters use subject to explicit, reviewable change.

  34. 2021 Apr

    PodSecurityPolicy is deprecated in Kubernetes 1.21

    The project deprecated PSP and announced removal in 1.25, citing usability problems that could not be fixed without breaking changes — notably that it was difficult to determine which policy applied to a given Pod.

  35. 2021 May

    CIS Controls version 8 reorganized secure configuration

    CIS Control 4 placed secure configuration across enterprise assets and software in one maintained process. The scope explicitly included network devices, servers, end-user devices, and other asset classes.

  36. 2021 May

    Colonial Pipeline disruption brings ransomware resilience into public focus

    The attack temporarily disrupted gasoline delivery across much of the southeastern United States. It showed how a cyber incident can quickly become an operational continuity event.

  37. 2021 May

    Executive Order 14028 defines the SBOM policy direction

    Executive Order 14028 defined an SBOM as a formal record of component details and supply-chain relationships. Component inventory gained a policy role beyond individual vulnerability scans.

  38. 2021 May

    Executive Order 14028 directs federal zero trust adoption

    The order required federal civilian agencies to plan for zero trust architecture. The directive made implementation an accountable government program rather than only an architectural recommendation.

  39. 2021 May

    Executive Order 14028 directs secure software practices

    Executive Order 14028 directed federal guidance for secure software development practices and supplier attestations. Secure development became a software supply-chain expectation for federal procurement.

  40. 2021 May

    Executive Order 14028 emphasizes supply-chain security

    The order established baseline security standards for software sold to the US government and called for greater software visibility.

  41. 2021 May

    JWT best current practices are published

    RFC 8725 documented JSON Web Token best current practices. It emphasized explicit algorithm, issuer, audience, and token-kind checks.

  42. 2021 May

    QUIC adopts TLS 1.3 in RFC 9001

    RFC 9001 specifies how TLS 1.3 secures QUIC, the UDP-based transport protocol behind HTTP/3. TLS provides the handshake and key schedule while QUIC replaces the record layer with its own packet protection.

  43. 2021 May 12

    U.S. executive order directs SBOM publication guidance

    Executive Order 14028 directed the publication of minimum elements for an SBOM. Component inventory became a formal supply-chain security expectation for software producers.

  44. 2021 May 12

    United States Executive Order 14028 issued

    The order directed federal action on software supply chain security and prompted standards and guidance for secure development and software evidence.

  45. 2021 May 12

    US cybersecurity order directs secure software guidance

    Executive Order 14028 directed NIST to issue guidance for practices that enhance software supply-chain security and secure development environments.

  46. 2021 May 12

    US Executive Order 14028 mandates zero trust and secure cloud

    Federal agencies were directed to adopt zero-trust architecture, multi-factor authentication, and encryption, and to move to secure cloud services on a fixed schedule. It pulled cloud security requirements from guidance into procurement.

  47. 2021 May 19

    Sigstore is introduced

    Sigstore was introduced as a public-good software signing service. Keyless signing and transparent verification became available for software supply-chain artifacts.

  48. 2021 Jun

    Google introduces the SLSA supply-chain integrity framework

    Google introduced SLSA as an end-to-end framework for supply-chain integrity. Dependency vulnerability matching was increasingly placed beside build and publication integrity controls.

  49. 2021 Jun

    LockBit adds built-in information theft tooling

    CISA records LockBit 2.0 and its StealBit tool in June 2021. The change reflects the defense problem covered here; restoration alone does not settle data-extortion risk.

  50. 2021 Jun

    Sigstore holds its first root-key ceremony

    Sigstore established a public trust root for its signing infrastructure. The project advanced an identity-based approach using shared trust services instead of per-project long-lived signer-key distribution.

  51. 2021 Jun

    SLSA is introduced

    SLSA introduced a framework for describing supply-chain integrity practices and verifiable build evidence.

  52. 2021 Aug

    NSA and CISA publish Kubernetes Hardening Guidance

    The two agencies released a cybersecurity technical report describing common threats to Kubernetes environments and the configuration that reduces them. It gave organizations an external, citable baseline rather than vendor guidance.

  53. 2021 Oct

    Fortra acquires Digital Guardian

    HelpSystems, later renamed Fortra, acquired Digital Guardian, one of the last large independent enterprise DLP vendors. Standalone DLP suites kept being absorbed into broader data-security portfolios.

  54. 2021 Oct 28

    Keycloak.X update announces Quarkus default path

    Maintainers published the plan to make a Quarkus-based distribution the default, with simpler configuration and a migration window away from WildFly.

  55. 2021 Nov

    Access Analyzer Policy Generation launched

    Generates fine-grained IAM policies from CloudTrail access activity, automating the path from over-permissive starter policies to least-privilege production policies.

  56. 2021 Dec

    Pod Security Admission reaches beta in Kubernetes 1.23

    The replacement for PSP arrived as a built-in admission controller driven by namespace labels, applying the Pod Security Standards in enforce, audit, and warn modes.

  57. 2021 Dec 10

    Log4Shell disclosed

    The remote code execution flaw in Apache Log4j created an urgent need to locate affected versions across deployed software inventories.

  58. 2022

    CISA publishes the Cloud Security Technical Reference Architecture

    Vendor-neutral guidance for secure cloud adoption and migration, covering shared services, zero trust, and continuous posture management. It consolidated a decade of practice into one reference architecture agencies and their vendors could build against.

  59. 2022

    Keycloak 17 makes Quarkus the default distribution

    Version 17 shipped Quarkus as the default distribution and deprecated the WildFly legacy distribution, changing server configuration and container packaging.

  60. 2022

    Microsoft publishes DevOps integration guidance

    Microsoft documented threat modeling as an evolutionary DevOps practice tied to actionable mitigations and implementation tracking. The guidance explicitly extends scope to modern supply-chain and deployment concerns.

  61. 2022

    Revised implementation guidance for 2018 description criteria

    Parallel revisions updated implementation guidance for the 2018 SOC 2 description criteria used to evaluate management's system description.

  62. 2022

    Revised points of focus for the 2017 TSC

    The AICPA published revised points of focus for the 2017 Trust Services Criteria, updating interpretive guidance used when applying the criteria in SOC 2 examinations.

  63. 2022 Jan

    OMB issues the Federal Zero Trust Strategy

    Memorandum M-22-09 set goals across identity, devices, networks, applications and workloads, and data. Agencies received concrete outcomes for translating the architecture into programs and controls.

  64. 2022 Feb

    NIST publishes SSDF 1.1

    NIST published SP 800-218, Secure Software Development Framework version 1.1. It supplied high-level practices that organizations can integrate into any SDLC and use as a common vocabulary with suppliers.

  65. 2022 Feb

    NIST publishes SSDF version 1.1

    NIST published SP 800-218 version 1.1 with secure development practices that include handling third-party software components. Dependency maintenance became part of a documented development lifecycle framework.

  67. 2022 Feb

    NIST SP 800-218 SSDF version 1.1 becomes final

    SP 800-218 replaced the original SSDF white paper and added secure-environment, provenance, and requirements guidance.

  68. 2022 Feb 3

    NIST published SSDF version 1.1

    NIST SP eight hundred dash two hundred eighteen standardized a core set of secure software development practices, including provenance tasks.

  69. 2022 Mar 23

    Ronin bridge validator keys compromised for roughly 625 million dollars

    Spear-phishing against a Sky Mavis employee, combined with a validator-signing allowlist grant that was never revoked, gave attackers enough validator signatures to forge withdrawals without touching any smart contract.

  70. 2022 Apr

    NIST reframed enterprise patching as preventive maintenance

    NIST SP 800-40 Revision 4 defined patch management as identifying, prioritizing, acquiring, installing, and verifying updates. This tied update verification to ongoing infrastructure risk reduction.

  71. 2022 May 03

    Kubernetes 1.24 stops auto-creating ServiceAccount token Secrets

    Before 1.24 the control plane created a permanent Secret-based token for every ServiceAccount. From 1.24 it does not, leaving projected, short-lived tokens from the TokenRequest API as the default workload credential.

  72. 2022 Jun

    WildFly distribution support window closes

    Project guidance set June 2022 as the end of support for the legacy WildFly distribution after the Quarkus default switch.

  73. 2022 Jul

    AWS SSO renamed to IAM Identity Center

    AWS Single Sign-On is repositioned as the recommended workforce identity service, connecting users to AWS accounts and applications through an organization instance.

  74. 2022 Jul

    NIST selects the first four algorithms

    NIST selected CRYSTALS-Kyber for general key establishment and Dilithium, FALCON, and SPHINCS+ for signatures.

  75. 2022 Aug

    ISO 31700 privacy by design standard published

    ISO 31700 established consumer-protection privacy-by-design requirements and guidance for consumer goods and services. It extended the design focus into organizational processes and product development.

  76. 2022 Aug

    Open Cybersecurity Schema Framework released

    AWS and partners released OCSF as an open specification for normalizing security telemetry across products and services. It addressed the common-schema stage that enables cross-source analytics.

  77. 2022 Aug

    Pod Security Admission becomes stable

    Kubernetes 1.25 made Pod Security Admission stable, providing a built-in admission path for Pod Security Standards profiles.

  78. 2022 Aug 25

    Pod Security Admission goes stable as PodSecurityPolicy is removed

    Kubernetes 1.25 shipped PSA as stable and removed PSP entirely, so workload hardening became a namespace label rather than a policy object bound through RBAC. Clusters still using PSP had to migrate before upgrading.

  79. 2022 Sep

    DoD Zero Trust Reference Architecture version 2.0 released

    The second reference architecture organized capabilities and activities for mission systems. It expanded the operational relationships around identity, devices, applications, data, networks, analytics, and automation.

  80. 2022 Sep

    Uber breached through MFA fatigue attack

    An attacker flooded a contractor with push notifications until one was approved, then used social engineering via WhatsApp to pressure the approval. The incident becomes the canonical example of push bombing and accelerates adoption of number matching and transaction context in push-based MFA.

  81. 2022 Oct

    CISA Cybersecurity Performance Goals released

    CISA published prioritized baseline practices that organizations can use to track and improve cybersecurity outcomes.

  82. 2022 Oct

    CISA issued phishing-resistant MFA guidance

    CISA published implementation guidance for phishing-resistant multifactor authentication. The guidance moved organizations from treating all additional factors alike toward selecting methods that resist impostor verifiers.

  83. 2022 Oct

    ISO/IEC 27001 receives its third edition

    The third edition refreshed the requirements for establishing, implementing, maintaining, and improving an information security management system. It preserved risk-based management while updating the standard's control context.

  84. 2022 Oct

    ISO/IEC 27001 third edition published

    ISO published the third edition of ISO/IEC 27001. Organizations applying the standard continued to use a requirements-based ISMS and risk-management approach.

  86. 2022 Nov

    DoD Zero Trust Strategy and Roadmap released

    The strategy connected department-wide adoption, secured systems, technology acceleration, and enabling processes to a target implementation roadmap.

  87. 2022 Nov

    NIST revises Engineering Trustworthy Secure Systems

    Revision 1 updated the engineering guidance and retained design principles as flexible tools for trustworthy secure systems across the life cycle.

  88. 2022 Nov

    TLS deployment guidance updated as RFC 9325

    Best Current Practice replacing RFC 7525, mandating TLS 1.2 as the minimum and providing cipher suite guidance that reflects the post-TLS 1.3 landscape. Deprecated TLS 1.0 and 1.1 for all new deployments.

  89. 2023

    OWASP updates the API Security Top 10

    The 2023 edition includes business-flow abuse, server-side request forgery, improper inventory management, and unsafe API consumption.

  90. 2023

    Weak-entropy wallet vulnerability disclosed (CVE-2023-39910, "Milk Sad")

    Wallets generated with Libbitcoin Explorer's bx seed command turned out to use a Mersenne Twister pseudorandom generator seeded with only 32 bits of system time, shrinking the practical key space enough for attackers to find and drain affected wallets.

  91. 2023 Mar 1

    ERC-4337 account abstraction deployed on Ethereum mainnet

    The EntryPoint contract and bundler infrastructure went live, letting smart contract wallets implement programmable validation such as social recovery and session keys without any change to Ethereum's protocol layer.

  92. 2023 Apr

    A second CNCF security audit is completed and open sourced

    A further third-party audit was published in full, establishing repeated external review as a norm for the project rather than a one-off exercise.

  93. 2023 Apr

    CISA publishes Zero Trust Maturity Model version 2.0

    The model defined traditional, initial, advanced, and optimal stages across five pillars and three cross-cutting capabilities. It gave operators a progression for automation, visibility, and integrated policy.

  94. 2023 Apr

    SLSA version 1.0 becomes final

    SLSA published its first stable version and added explicit verification guidance for provenance. The milestone reinforced that producing signed evidence is insufficient unless consumers compare it with expectations.

  95. 2023 Apr

    SLSA version 1.0 released

    The stable specification defined build integrity levels and provenance requirements for software artifacts.

  96. 2023 Apr

    Windows LAPS is delivered through Windows updates

    Windows LAPS became available on supported Windows client and server platforms through the April 2023 updates. It added a built-in management path for local and DSRM passwords.

  97. 2023 Apr 10

    Keycloak joins CNCF at Incubating level

    The Cloud Native Computing Foundation accepted Keycloak as an incubating project.

  98. 2023 Apr 19

    SLSA version 1.0 becomes final

    SLSA released its first stable version. Provenance moved toward a stable, verifiable contract for build inputs, builder identity, and artifact subjects.

  99. 2023 May

    Apple, Google, and Microsoft commit to passkey adoption

    The three major platform vendors announce synchronized passkey support across their ecosystems. A 2024 FIDO Alliance survey finds fifty-three percent of people have enabled passkeys on at least one account, signaling the transition from security-key-only FIDO to consumer-scale passwordless authentication.

  100. 2023 May 16

    KMS v2 moves to beta in Kubernetes 1.27

    The second-generation KMS provider reworked encryption at rest around key hierarchy, rotation, health checks, and observability, addressing the performance limits that discouraged KMS v1 adoption.

  101. 2023 May 16

    Ledger announces Ledger Recover, drawing custody-model backlash

    The optional seed-backup service split an encrypted copy of a user's key material across three custodians; critics argued this contradicted the hardware-wallet premise that a key never leaves the device, and Ledger postponed the launch a week later.

  102. 2023 May 23

    Experimental HTTP/3 support is added

    nginx 1.25.0 added experimental HTTP/3 support. Edge review had to account for another transport path and its corresponding configuration and test coverage.

  103. 2023 Jun

    CISA publishes a detailed LockBit defender advisory

    The advisory documented LockBit activity, affiliate variation, and mitigation recommendations. It connected ransomware response to continual testing of controls against observed attacker techniques.

  104. 2023 Jul

    SEC adopts cybersecurity disclosure rules

    The SEC adopted rules requiring covered public companies to describe cybersecurity risk management, strategy, governance, and incident disclosure. Board oversight and management roles became explicit disclosure subjects for those issuers.

  105. 2023 Aug

    Draft FIPS 203, 204, and 205 open for comment

    NIST published draft standards for algorithms later named ML-KEM, ML-DSA, and SLH-DSA and invited public feedback.

  106. 2023 Sep

    CISA published its Open Source Software Security Roadmap

    CISA set goals for understanding open source dependency prevalence, reducing federal risk, and hardening the wider ecosystem.

  107. 2023 Sep

    DPoP published as RFC 9449

    DPoP standardized a proof-of-possession mechanism for OAuth access tokens, addressing replay risk when a token is presented by an unintended party.

  108. 2023 Sep

    MGM Resorts breached via help-desk social engineering

    Scattered Spider impersonated an MGM employee over the phone, got the IT help desk to reset MFA, and deployed ransomware across 30+ properties. The $100 million loss demonstrates that MFA protection collapses when help-desk recovery procedures rely on knowledge factors available in breach databases.

  109. 2023 Sep

    NIST publishes SP 800-207A

    The publication adapted zero trust access control to cloud-native applications across multiple clouds. It added identity-tier and network-tier policies, service meshes, and gateways to the implementation vocabulary.

  110. 2023 Sep 30

    Current TSC download package dated on AICPA site

    AICPA & CIMA listed the consolidated 2017 Trust Services Criteria with 2022 revised points of focus as a current free download resource for practitioners and service organizations.

  111. 2023 Oct

    NIST publishes SP 800-92 Revision 1 draft

    NIST published a new planning guide focused on organization-wide improvement of cybersecurity log management. The revision reframed log management as a continuing program of generation, transmission, storage, access, and disposal.

  112. 2023 Oct

    Okta support system compromise exposes session tokens

    Attackers extracted HAR files containing session tokens from Okta customer support system, bypassing MFA entirely because the tokens represented already-authenticated sessions. The incident affects roughly 18,000 customer accounts and reinforces that session lifecycle management is part of MFA real assurance boundary.

  113. 2023 Nov

    RFC 9525 updates TLS service identity verification

    RFC 9525 updated service-identity verification for TLS. It clarified how clients compare a reference identity with identifiers presented in a certificate.

  114. 2023 Nov 15

    Red Hat build of Keycloak GA replaces RH-SSO roadmap

    Red Hat generally available the Red Hat build of Keycloak as the commercial IAM offering based on Quarkus Keycloak, replacing plans for a further Red Hat Single Sign-On major line.

  115. 2023 Dec 13

    KMS v2 becomes stable and KMS v1 is disabled by default

    Kubernetes 1.29 marked KMS v2 stable. KMS v1, deprecated in 1.28, was disabled by default from the same release and requires an explicit feature gate to use.

  116. 2023 Dec 14

    Ledger Connect Kit compromised in a supply-chain attack

    A phished former employee's credentials let attackers publish malicious versions of a widely used wallet-connector npm package, injecting fund-draining code into dozens of applications before Ledger pulled the versions roughly five hours later.

  117. 2024

    Lightweight access tokens become a supported option

    Keycloak added supported lightweight access token behavior so clients can carry fewer JWT claims and use introspection or userinfo for the rest.

  118. 2024 Feb

    Gmail bulk-sender requirements take effect

    Gmail required bulk senders to use SPF, DKIM, and DMARC, alongside TLS and spam-rate requirements. Authentication became a delivery prerequisite for many senders.

  119. 2024 Feb

    NIST CSF 2.0 adds Govern and broadens its audience

    The update added Govern to the core functions and presented cybersecurity outcomes for organizations of every size and sector.

  120. 2024 Feb

    NIST Cybersecurity Framework 2.0 adds Govern

    CSF 2.0 expanded its audience to all organizations and made governance a separate Function spanning strategy, roles, policy, oversight, and supply-chain risk.

  121. 2024 Feb

    NIST Cybersecurity Framework 2.0 released

    CSF 2.0 broadened the framework's governance emphasis and refreshed the outcome structure used to relate measures to cybersecurity objectives.

  123. 2024 Feb 26

    NIST Cybersecurity Framework 2.0 released

    NIST released CSF 2.0 for organizations of any sector or size and added the Govern function. The framework now organizes cybersecurity risk outcomes around six concurrent functions.

  124. 2024 Feb 26

    NIST releases Cybersecurity Framework 2.0

    CSF 2.0 expanded its intended audience to all organizations and added Govern as a distinct function. Policy, roles, oversight, and enterprise risk alignment became more visible across the framework.

  125. 2024 Mar

    The XZ Utils backdoor is reported

    A report to the oss-security mailing list described a backdoor in upstream xz releases that could affect SSH server compromise. The incident showed why known-vulnerability matching alone cannot cover malicious changes in a dependency supply path.

  126. 2024 Mar 29

    xz Utils compromise disclosed

    Investigators found malicious code in release tarballs of xz versions five point six point zero and five point six point one, demonstrating a targeted compromise of an upstream release path.

  127. 2024 Apr 22

    NIST published syncable-authenticator guidance

    NIST added interim guidance for syncable authenticators such as passkeys. Phishing-resistant authentication became easier to deploy across devices while introducing recovery and synchronization considerations.

  128. 2024 Apr 24

    ValidatingAdmissionPolicy is generally available in Kubernetes 1.30

    Policy rules written in CEL began running inside the API server as a declarative alternative to validating admission webhooks, removing an external HTTP callout from the admission path for many organizational rules.

  129. 2024 May

    CIS Controls version 8.1 adds governance recommendations

    CIS released Controls v8.1 with governance recommendations for policies, procedures, processes, and compliance evidence. The update connected prioritized safeguards more directly to governance practice.

  130. 2024 Aug

    FIPS 203, 204, and 205 become final

    The first three NIST PQC standards became available for immediate implementation in products, services, and protocols.

  132. 2024 Dec

    NIST SP 800-55 Volumes 1 and 2 released

    NIST replaced the earlier guide with separate volumes for selecting measures and developing a measurement program.

  133. 2025

    CISA updates SBOM minimum elements

    CISA updated guidance for SBOM data, automation support, practices, processes, coverage, and frequency.

  134. 2025 Jan

    OAuth 2.0 Security Best Current Practice published as RFC 9700

    The guidance consolidated modern OAuth security recommendations, including authorization-code flow, redirect, token, and replay protections relevant to OpenID Connect deployments.

  135. 2025 Feb 21

    Bybit loses roughly 1.4 billion dollars through a disguised Safe transaction

    Attackers used a compromised Safe developer's machine to disguise a malicious transaction; Bybit's own account describes signers seeing a masked interface showing the correct address while the actual request changed control of the cold wallet, with no flaw found in the Safe contracts or frontend source code.

  137. 2025 Jun

    NIST publishes API protection guidance

    NIST SP 800-228 organized controls across pre-runtime and runtime lifecycle stages for cloud-native systems.