Network: Part 8. Security

The era of lost trust

In September 1986, the accounting department of the Lawrence Berkeley National Laboratory discovered a discrepancy of seventy-five cents in the computer bills: someone was consuming machine time without paying for it. The system administrator Clifford Stoll, instead of writing off the pennies to a rounding error, spent ten months tracking the intruder: he wrote his own interception programs, printed out teletype logs, and stood watch at night, until he found out that data from the laboratory, connected to the US Department of Energy, was going to West Germany — and from there to the KGB. The intruder turned out to be the hacker Markus Hess; Stoll's book "The Cuckoo's Egg" (1989) became the first bestseller about computer crimes. Seventy-five cents turned into the first public proof that the network built on trust was already being used by someone as a weapon. Forty years later, network security looks like this. By the estimate of Cybersecurity Ventures, cybercrime costs the world approximately 10.5 trillion dollars a year — and, by their own forecast, by 2031 this figure will grow to 12.2 trillion; the average cost of a data breach reached a record 4.99 million dollars, adding 12% over the year (IBM, 2026); the exploitation of vulnerabilities for the first time became the main method of intrusion — 31% of intrusions — pushing aside credential theft; the human factor is present in 62% of incidents (Verizon DBIR, 2026); the largest reflected DDoS attack reached 31.4 terabits per second (Cloudflare, fourth quarter of 2025); more than 95% of page loads in Chrome go over encrypted HTTPS; the certificate authority Let's Encrypt issues about ten million certificates per day; about five billion hardware passkey keys are in use in the world (FIDO Alliance, May 2026); and more than half of web traffic is already protected by hybrid post-quantum key exchange — in two years the share grew from two percent.

The paradox of network security is that it was never there in the Internet. The TCP/IP protocols were designed in the early 1980s by a community of several thousand researchers who knew each other by face: IP does not verify the authenticity of the sender, DNS does not sign responses, ARP believes anyone, TCP is predictable in its numbers, and telnet and FTP transmit passwords in open text. Security was not built in not out of naivety — out of economy: every complication would have cost memory and processor time, which the machines of the time did not have. When the network went beyond the trusted circle of universities and laboratories, the holes had to be closed on the fly — with layers of cryptography grown over the protocols, like armor over a skeleton. Over forty years, this race of "attack — defense — new attack" gave birth to a whole industry: TLS encrypted almost all web traffic, Let's Encrypt handed out certificates to hundreds of millions of sites, hardware keys and passkeys are displacing passwords, and post-quantum cryptography began to be deployed before quantum computers capable of breaking it appeared. And yet the principle has not changed: security is a chain, strong exactly as much as its weakest link is strong. Perfect cryptography does not save you from the password 123456, and billion-dollar SOCs do not save you from a call to the support service.

This situation gives rise to a series of critical questions:

1. The question of keys. How do two parties who have never seen each other agree on a common secret over a channel that is being wiretapped? The answer found by Diffie and Hellman in 1976 seemed like modern magic: a common key arises from an exchange of public parameters in such a way that the eavesdropper cannot compute it. Why is this discovery called a turning point in the history of cryptography — and how is it connected with the works of the British intelligence service GCHQ, declassified only in 1997?
2. The question of trust. How does the browser know that the bank's certificate is genuine? The answer: one of several hundred root certificate authorities built into the operating systems told it so. The centralized factory of trust holds the entire Internet on its word of honor — and history knows what happens when the word is broken: the DigiNotar breach in 2011 allowed intercepting the correspondence of hundreds of thousands of Gmail users in Iran, and the company itself went bankrupt within a matter of weeks.
3. The question of the human. Cryptography is not broken head-on — it is bypassed. In 62% of incidents a human is present: phishing, telephone social engineering, MFA fatigue, passwords leaked from other people's services. Why is it more profitable for attackers to call the support service than to break the cipher — and what does the industry oppose to this, from passkeys to training?
4. The architectural question. Where should the protection live: in Wi-Fi (WPA3), at the network level (IPsec), at the transport and application levels (TLS)? The lower the level, the more transparent the protection and the less it knows about the meaning of the data; the higher — the more flexible it is, but the more places where someone forgot to turn it on. Why did the Internet choose TLS, although IPsec is older and "more correct" — and why is security still end-to-end today?
5. The question of the race. Each generation of protection gives birth to a new generation of attacks: BEAST, CRIME, POODLE, FREAK, Logjam, Heartbleed — the names of TLS vulnerabilities read like a list of serial killers. The asymmetry is ruthless: the defender must close everything; the attacker needs only one hole. Why was Log4Shell of 2021 called the most massive vulnerability of the decade — and what did the story with the backdoor in the xz archiver in 2024 teach the industry?
6. The question of metadata. Encryption hides the content, but not the fact of communication: who, with whom, when, and how much. Traffic analysis survives TLS — while Tor, mix networks, and the end-to-end encryption of messengers try to close this gap too. Why has the dispute about "going dark" — the access of the intelligence services to correspondence — been going on for thirty years, from the Clipper Chip to the British Online Safety Act, and why do cryptographers win technically every time but not always politically?
7. The question of time. The encrypted traffic intercepted today can be decrypted tomorrow: adversaries are already now collecting data counting on future quantum computers (harvest now, decrypt later). In August 2024, NIST approved the first post-quantum standards, and browsers and CDNs deployed hybrid key exchange before a quantum machine broke a single RSA key. Why is the migration measured in decades, and what is cryptographic agility?

Next we will go through all of network security: from the birth of the industry and the goals of protection — through symmetric and asymmetric cryptography, hashes and signatures, the public key infrastructure, authentication from passwords to passkeys — to TLS, IPsec and VPNs, the protection of Wi-Fi, reconnaissance and "man-in-the-middle" attacks, DDoS, malicious programs and extortionists, attacks on the supply chain, firewalls and zero trust, web security, privacy, economics, and the human factor — and we will finish with the quantum future of cryptography. In the finale we will trace the path of one intrusion — from a phishing letter to an incident report — and see how all the dissected mechanisms add up into a single defense. The material is based on IETF and NIST standards, documented incidents, and industry statistics of 2025–2026.

The birth of security: from universal trust to defense

A network where everyone is one of our own

For the first fifteen years the Internet did not need security for the same reason a professors' club did not need it: all the participants were known to each other, and abuse would have meant expulsion from the community. The network was described as an open community of like-minded people: the participants numbered in the thousands, they knew each other by face, electronic mail was not signed, remote login through telnet transmitted the password in the very first packet, and the routing protocols believed any announcement. The first warning was the Stoll case of 1986–1987: a loner, not an intelligence service, could for months read other people's mail and documents while remaining unnoticed, because the very idea of "intrusion monitoring" did not yet exist. Stoll, in essence, invented it in practice — an event log, traffic interception, a trap decoy.

On November 2, 1988, a worm was launched by Cornell graduate student Robert Tappan Morris, conceived as a harmless experiment to measure the size of the Internet. The program contained an error: instead of one instance per machine, it multiplied repeatedly and clogged the resources. Of the approximately sixty thousand computers connected to ARPANET, the worm hit about six thousand — every tenth machine in the world. The damage was estimated at from one hundred to ninety-six million dollars; Morris received three years' probation, a fine of ten and a half thousand dollars, and four hundred hours of community service, and subsequently became a professor at MIT and a co-founder of Y Combinator. The main consequence of the worm was something else: in that same November of 1988, DARPA funded the creation of CERT/CC — the computer incident response team at Carnegie Mellon University. Thus the Internet acquired the profession of defender.

From hooligans to an industry

The nineties turned security from academic exoticism into an industry. In 1994 Netscape released SSL — the first mass encryption protocol for the web; in 1995 Tatu Ylönen, after the interception of passwords in his university's network, wrote SSH in one week; and in 1997 NIST announced an open contest to replace DES — thus began the public era of cryptographic standards. In February 2000, the fifteen-year-old Canadian Michael Calce, aka Mafiaboy, laid low Yahoo, eBay, CNN, Amazon, and Dell with DDoS attacks — the total damage was estimated in billions, and the hearings in the US Congress for the first time raised the question of protecting the commercial Internet. May of the same year — the ILOVEYOU virus of the Filipino Onel de Guzman hit tens of millions of machines in a day; de Guzman was not convicted only because the Philippines had no law on computer crimes — it was adopted two months after the epidemic.

The beginning of the 2000s showed the speed with which the network became vulnerable. On January 25, 2003, the Slammer worm — a UDP packet of 376 bytes striking port 1434 of Microsoft SQL servers — doubled the number of infected every 8.5 seconds and hit 90% of the vulnerable machines on the planet in ten minutes. The patch had existed for six months; most of the victims simply had not installed it. MyDoom in January 2004 became the fastest mail worm in history — at its peak, every twelfth letter in the world carried its copy, and the total damage, adjusted for inflation, is estimated at almost 38 billion dollars. The era of "childish pranks" was ending: in its place came organized cybercrime, corporate espionage, and state operations — from Stuxnet (2010) to NotPetya (2017) and SolarWinds (2020), which we will dissect further. The key lesson of the first two decades: security is not a state, but a process, because the adversary adapts faster than the systems are updated.

Goals and models: what a protected system means

The four properties and the fifth leg

The classic formula of security goals is the CIA triad plus non-repudiation. Confidentiality: the data is read only by the one for whom it is intended — it is provided by encryption (TLS, VPN) and access control. Integrity: the data is not altered during transmission or storage — it is provided by hashes, HMAC, and digital signatures. Availability: the service works when needed — against it are directed DDoS attacks, extortionists, and even one's own configuration errors. Authentication: confidence about whom you are dealing with — passwords, certificates, hardware keys. And non-repudiation: the sender cannot later declare "I did not do this" — it is given by the digital signature, which in a number of jurisdictions has legal force. In practice the properties are interwoven: TLS provides at once the confidentiality, integrity, and authentication of the server, while availability remains on the conscience of other mechanisms.

Kerckhoffs's principle and the weak link

In 1883, the Dutch cryptographer Auguste Kerckhoffs formulated the principle that became the foundation of all modern cryptography: the strength of a system must rest solely on the secrecy of the key, not on the secrecy of the algorithm. The algorithm will be learned anyway — stolen, restored from the implementation, published, as happened with the GCHQ developments declassified in 1997. Hence the modern norm: AES, RSA, SHA, and TLS are fully open; millions of specialists study them, and it is precisely the publicity that makes them reliable — security through obscurity does not work, because the "obscure" sooner or later becomes clear. The second fundamental principle: security is a chain. HTTPS on a site does not save you if the administrator's password is "123456"; perfect encryption is useless if the key was generated by a weak random number sensor or lies in the application's code. The attacker does not choose the strongest link — he looks for the weakest one, and the defense must take into account all the links at once: people, processes, configurations, protocols, and mathematics.

The attacker model and the kill chain

Professional protection begins not with tools, but with a model of the adversary: who is attacking (a script kiddie, an organized group, an insider, a state intelligence service), what resources they have, and what their goal is — theft, destruction, espionage, extortion. The budget and the architecture depend on the answer: one thing will protect against a banking trojan, something quite different against an adversary of the Stuxnet level. The practical model of an attack is the kill chain — the sequence of steps of an intrusion, formalized by Lockheed Martin in 2011 and developed in the MITRE ATT&CK matrix (2013):

reconnaissance → point of entry → consolidation → lateral movement → achieving the goal → exfiltration of data

Reconnaissance collects the attack surface: IP ranges, DNS records, open ports, software versions, employees on social networks. The point of entry is a vulnerable service, an injection, phishing. Consolidation is a backdoor, a new user, a task scheduler. Then movement inside the network from the web server to the database and to the domain, and finally the goal: the data is encrypted, stolen, or destroyed. The value of the model is that the defense does not have to win every stage: it is enough to break the chain at any point — and the more independent barriers on the way, the more expensive the attack. Hence the principle of defense in depth: the firewall, segmentation, encryption, MFA, monitoring, and training do not duplicate each other in vain — they count on the fact that the previous layer has already been breached.

Where the protection lives in the stack of layers

Security does not belong to one level of the model: at the data link level works WPA3 for Wi-Fi, at the network level — IPsec and packet filtering, at the transport and application levels — TLS, above — passwords, tokens, transaction signatures. The choice of level is a compromise: protection lower down is more transparent (the applications need not know anything) and more universal, but coarser; protection higher up understands the meaning of the data (whom to authenticate, what to sign), but every application must implement it itself — and there will inevitably be one that forgets. History arranged it so that the Internet bet on application-level TLS, not on network-level IPsec: the latter turned out to be too complex for mass deployment and took root in VPN tunnels, while TLS encrypted almost all the traffic of browsers, mail, and APIs. The modern answer to the question "where to do security" is everywhere at once, because an end-to-end system protects not a level, but the path of the data from source to consumer.

Symmetric cryptography: one key for two

From Shannon to DES

The scientific foundation of encryption was laid by Claude Shannon in a secret report of 1945, published in 1949 as "Communication Theory of Secrecy Systems": he proved that an absolutely strong cipher exists — it is Vernam's one-time pad, where the key is longer than the message and is never used twice — and that all other ciphers are strong only to the extent that they are hard to break. Absolute strength turned out to be impractical: the key must be transmitted as securely as the message itself. Throughout the twentieth century, cryptography solved one task — to make the keys short and reusable without losing strength.

The first mass answer was DES. In the early 1970s, IBM developed the Lucifer cipher under the direction of Horst Feistel; in 1973 the US National Bureau of Standards announced an open contest, and in November 1976 the improved Lucifer was approved as the federal standard with a key length of 56 bits. The history of DES is also the first cryptographic drama: the NSA insisted on shortening the key and on modifying the S-boxes, which gave rise to twenty years of suspicions of a backdoor. The suspicions turned out to be in vain — on the contrary, in 1990 Eli Biham and Adi Shamir published differential cryptanalysis, and IBM admitted that it had known about it back in 1974: the NSA's edits made the cipher more resistant. But 56 bits was too little. In 1997, enthusiasts of the DESCHALL project led by Rocke Verser broke the key by distributed computations of thousands of volunteers in 96 days; in 1998 the EFF built the specialized machine Deep Crack for 250 thousand dollars — it found the key in 56 hours; in January 1999, paired with distributed.net — in 22 hours 15 minutes. The standard that had protected bank transactions for twenty years died publicly. In 2005, DES was officially excluded from the list of approved standards.

AES and the modes of operation

As its replacement, NIST held the first fully open cryptographic contest: in 1997 applications were accepted from all over the world, in 1999 five finalists were selected (MARS from IBM, RC6 from RSA Security, Rijndael, Serpent, Twofish), and on October 2, 2000, the Belgian Rijndael of Joan Daemen and Vincent Rijmen was declared the winner. In November 2001 it became the AES standard (FIPS 197): blocks of 128 bits, keys of 128, 192, or 256 bits, no secret S-boxes and no participation of the intelligence services in the design. AES has withstood a quarter century of attacks: there is still no practical break of the full number of rounds, and since 2010 the AES-NI instructions in Intel processors have made encryption almost free — gigabytes per second per core.

One and the same cipher can be applied in different ways, and the modes of operation turned out to be more dangerous than the algorithm itself. The ECB mode encrypts each block independently: identical blocks give identical ciphertext, and the famous Tux penguin in the illustration of the ECB mode remains a recognizable silhouette — ECB is forbidden for everything except teaching examples. The CBC mode chains the blocks and requires a unique initialization vector; a repeated IV or a predictable IV gives rise to attacks like BEAST. Worse, CBC with padding checking is vulnerable to the padding oracle: if the server reveals by different responses or different response times whether the padding is correct, the attacker decrypts the message byte by byte by sending modified blocks — this is how the Lucky13 (2013) and POODLE (2014) attacks worked, the latter burying SSL 3.0. The modern answer is the GCM mode (Galois/Counter Mode): it combines encryption with authentication (AEAD), produces an integrity tag, and is built into every cipher suite of TLS 1.3. The lesson of the GCM mode is simple: you must not first encrypt and then "stitch on" integrity with a separate HMAC — you must use constructions where they are inseparable.

Asymmetric cryptography: a key that can be published

"New Directions in Cryptography"

The problem of key distribution seemed unsolvable: to exchange ciphertext, the parties must in advance, over a protected channel, transmit to each other a common key. In 1974, Ralph Merkle, a student at Berkeley, invented "Merkle's puzzles" — a task that is easy for the initiator to solve but quadratically more expensive for the eavesdropper — and sent the work for review; Nicholas Negroponte rejected it. In 1976, Whitfield Diffie and Martin Hellman published the article "New Directions in Cryptography" with the first practical key exchange protocol: the parties exchange powers of a common base over an open channel, each raises the received number to its own secret power — and independently arrive at one and the same common secret. The eavesdropper sees only two public numbers; to obtain the secret, he needs to solve the discrete logarithm problem, exponentially complex. Diffie and Hellman also proposed the very concept of the digital signature. In 2015 they received the Turing Award; Merkle was not on the lists, but his priority is universally recognized. And in 1997 the British government declassified the GCHQ materials: Clifford Cocks had invented a public-key scheme back in 1973 — four years before the open publication of RSA. The intelligence service knew the answer earlier, but could not use it: there was not enough computing power.

RSA and factorization

In 1977, Ron Rivest and Adi Shamir of MIT, together with Leonard Adleman, built the first practical public-key system — RSA. At its base is another hard problem: multiplying two large primes is easy, but factoring the product back into its factors is practically impossible. From a pair of primes the private key is obtained; their product enters the public one. The same mechanism works as a signature too: only the owner can "encrypt" the hash of a document with the private key, and anyone can verify it. In honor of the cipher, the RSA-129 challenge was established: 100 dollars were promised for factoring a 129-digit number. It was thought that this would take thousands of years; in April 1994, six hundred volunteers from twenty countries coped in eight months, transmitting the phrase "The Magic Words are Squeamish Ossifrage." Since then the records moved methodically: RSA-768 (232 decimal digits) was factored in December 2009 for the equivalent of two thousand processor years; in February 2020 RSA-250 fell too — a number of 250 digits. The practical conclusion: RSA keys shorter than 2048 bits are considered unreliable; 3072 bits is the minimum NIST recommendation for new systems; and for comparable strength on elliptic curves (ECC, independently proposed by Neal Koblitz and Victor Miller in 1985; Daniel Bernstein's Curve25519, 2006) 256 bits suffice. ECC saves keys and time — it is precisely elliptic curves (ECDHE) that provide the key exchange in modern TLS.

The hybrid scheme and the quality of randomness

Asymmetric cryptography is hundreds and thousands of times slower than symmetric, so in reality it is almost never used for encrypting data. A hybrid works: the asymmetric protocol (ECDHE or RSA) only negotiates the symmetric session key, and then the fast AES-GCM or ChaCha20-Poly1305 encrypts the terabytes of traffic. This is exactly how TLS is built, and IPsec and SSH are built the same way: the mathematically expensive part — once per handshake, the cheap part — for the whole session.

The foundation of all the asymmetry is randomness: keys, initialization vectors, and nonces must be unpredictable, and the random number generator becomes the weakest link. In 2008 it turned out that, because of an error in the Debian OpenSSL package, for two years it had been issuing predictable keys — hundreds of thousands of servers had to reissue their certificates. In 2010, Sony used one and the same constant instead of a random number in the signature of the PlayStation 3 firmware — the console's protection collapsed in a week. In 2017, the ROCA vulnerability in the Infineon library gave birth to hundreds of thousands of RSA keys recoverable from the public part — the defect was found in the national ID cards of Estonia. The conclusion of the industry norm: cryptography is broken not by mathematics, but by implementation — and that is why implementations are checked by audit, and randomness is taken from hardware generators.

Hashes, HMAC, and digital signatures

Hash functions: the fingerprint of data

A cryptographic hash turns a message of arbitrary length into a short fixed fingerprint, and does it in such a way that from the fingerprint one cannot restore the original (preimage resistance), cannot find two different messages with one fingerprint (collision resistance), and changing one bit of the input changes about half the bits of the output. Hashes are the universal glue of security: digital signatures, password storage, integrity control of downloads, blockchains, and Certificate Transparency rest on them.

The history of hashes is a chronicle of falls. MD4 and MD5 by Ronald Rivest (1990 and 1992) seemed unshakable until in 2004 the Chinese mathematician Wang Xiaoyun demonstrated the construction of MD5 collisions in minutes: two different documents with the same fingerprint. A practical application was found quickly — in 2012 the Flame worm used an MD5 collision to forge a Microsoft signature and spread through Windows Update. SHA-1 (1995) held out longer: on February 23, 2017, researchers of CWI Amsterdam and Google announced SHAttered — the first real collision, costing the equivalent of six and a half thousand processor years; the browsers by that moment were already disabling certificates with SHA-1, and PDF signatures on SHA-1 lost their force. Today's norm is SHA-256 from the SHA-2 family and its successor SHA-3 (the FIPS 202 standard, August 2015, built on the Keccak construction, not related to SHA-2 — an insurance in case SHA-2 ever falls too). Ordinary hashes are not good for passwords: they are too fast, and billions of substitutions per second on a GPU run through dictionary passwords instantly. Therefore passwords are hashed with slow adaptive functions with a salt — bcrypt (Provos and Mazières, 1999), scrypt (2009), and today Argon2 is preferred, the winner of the Password Hashing Competition of 2015 (RFC 9106).

HMAC and the signature

A hash without a key proves only that the data did not change accidentally — forging a new correct hash is trivial for an attacker. HMAC (RFC 2104, 1997) adds a secret key to the construction: only the one who knows it can compute and verify the authentication code. HMAC is used in IPsec, in the signing of JWT tokens, in authentication protocols, and inside TLS 1.2 as the integrity code of records.

A digital signature joins the hash with asymmetric cryptography: the sender computes the hash of the document and "signs" it with the private key; the recipient verifies the signature with the public key and compares the hash. The signature solves two tasks — authentication of the sender and integrity of the document — and also provides non-repudiation: the private key was only with the signer, and he cannot renounce authorship. Signatures protect software updates, PDF documents, mail messages (DKIM), transactions, and PKI certificates. The same elliptic curves made signatures compact: Ed25519 signs and verifies many times faster than RSA at a 128-bit strength level.

PKI: the factory of trust

Certificates and chains

Asymmetric cryptography solves the question "how to transmit the key," but does not solve the question "whose key is this." Anyone can publish a public key and call it the bank's key. The answer is the public key infrastructure (PKI): identity papers for keys. The X.509 standard (ITU-T, 1988; internet profile RFC 5280) describes the certificate: the owner's public key, his domain name, the validity period, the issuer, and the issuer's signature. The issuer is a certificate authority (CA), whose own certificate is signed by a higher center, and the roots — by themselves (self-signed) and preinstalled in the operating systems and browsers. The verification is simple: the browser receives the site's certificate, builds a chain to a trusted root, checks the signatures at every step, the validity period, and the match of the domain name. In the world there are several hundred trusted root CAs — from giants like DigiCert, Sectigo, and Google Trust Services to the state certificate authority of Russia; Let's Encrypt issues certificates free of charge and automatically.

The weakness of the system is obvious: trust is transitive, and any of the hundreds of centers can issue a certificate for someone else's domain — the browser will accept it. History confirmed this many times. In March 2011, through the Italian reseller of Comodo, forged certificates were issued for google.com, yahoo.com, and Skype. In the summer of 2011, the Dutch CA DigiNotar was breached: the attackers issued certificates for Google domains and used them to intercept the correspondence of about three hundred thousand Iranian users of Gmail; the company went bankrupt two months later. In 2017, Google announced the phased distrust of Symantec certificates after an employee issued test certificates for google.com — Symantec sold its certificate authority business to DigiCert for 950 million dollars. The industry's reaction was Certificate Transparency (RFC 6962, 2013): public logs into which CAs are obliged to enter every issued certificate — a forged issuance is now visible to the whole world; CAA records in DNS (RFC 8659), allowing a domain to indicate the list of authorized CAs; and the transition to short-lived certificates — in 2025 the CA/Browser Forum voted to reduce the maximum lifetime of a certificate to 200 days from March 2026, to 100 days from 2027, and to 47 days from 2029: a stolen key will become useless within weeks.

Revocation, pinning, and the automation of trust

A separate problem is revocation: a certificate is compromised before its term expires, and it must be declared invalid. Certificate revocation lists (CRL) are cumbersome; the OCSP protocol forces the browser to ask the CA in real time, revealing to it the browsing history and slowing down the connection; in practice the browsers check revocation inconsistently, and OCSP stapling shifts the task onto the server. There is no full solution — the industry bets on a short validity period as the main revocation mechanism. Certificate pinning complements the picture: the application nails down in advance the expected key, as mobile banks did; the HPKP standard for the web failed (it is too easy to "shoot yourself in the foot") and was removed from browsers by 2019.

Let's Encrypt changed the economics of trust radically. Launched in December 2015 by the Internet Security Research Group, the center automated issuance through the ACME protocol: a certificate is requested and renewed by a script, without letters and payment. The result: ten years later the center issues on the order of ten million certificates per day; almost two thirds of all websites use its certificate (W3Techs, October 2026); and the share of HTTPS loads in Chrome exceeded 95%. In January 2026, Let's Encrypt added six-day certificates — a step into a future where keys live for days and trust is fully automated. The alternative model is PGP's web of trust, where users sign each other's keys without single centers — technically elegant, but it remained niche: people find it more convenient to delegate trust to an institution, even an imperfect one, than to build it themselves.

The crypto wars: the state against mathematics

PKI grew up in the midst of the crypto wars — a thirty-year struggle of the states for control over encryption. In 1993 the NSA proposed the Clipper Chip: a cipher with a hardware escrow key for wiretapping by court decision; in 1994 Matt Blaze showed that the control mechanism breaks; and by 1996 the project quietly died. Until 2000, strong cryptography was considered a munition in the USA: the export of PGP was a criminal offense, and Phil Zimmermann, having published it in 1991, spent three years under investigation — after which he published the source code as a book with MIT Press, formally using the constitutional protection of the press. Daniel Bernstein in 1995 filed a suit proving that cryptographic code is speech; in 1999 the appeals court agreed with him, and the export rules were liberalized. Having lost the war for control, the states moved to the war for backdoors — the dispute about "going dark" continues to this day, and every round (Apple versus the FBI in 2016, the British Online Safety Act, the Australian law of 2018) cryptographers win by one argument: a backdoor for the "good" cannot be made unavailable to the "bad."

Authentication: passwords, tickets, and hardware keys

The password: the oldest and weakest link

The password was invented together with the division of access to computers in the early 1960s at MIT (the CTSS system), and sixty years later it remains the main way to get in almost everywhere — and the main cause of breaches. The statistics are ruthless: in the NordPass list of 2025, the first place was again taken by "123456," followed by "admin" and "12345678"; such passwords are picked by tools in less than a second. Worse, passwords are reused: a password leaked from one service opens dozens of others. Troy Hunt's Have I Been Pwned project has accumulated billions of records from breaches — the "Collection #1" of 2019 alone contained 773 million email addresses and 21 million passwords — and the Pwned Passwords service allows checking a password without revealing it (the k-anonymity protocol).

Storing passwords in open text is impossible, and with fast hashes too: GPUs run through billions of candidates per second, and rainbow tables find matches instantly. The correct practice is a slow adaptive hash with an individual salt per user (bcrypt, Argon2), limiting the frequency of login attempts, and checking the password against breach databases. Transmitting the password over the network in open form is also impossible — hence challenge-response: the server sends a random number (nonce), the client proves knowledge of the password by computing the response, the password itself does not travel over the channel, and the nonce makes the replay of an intercepted response meaningless.

Kerberos: tickets instead of passwords

In the 1980s, in the Athena project of the Massachusetts Institute of Technology, the idea was born of centralized authentication without transmitting passwords over the network — Kerberos, named after the three-headed dog Cerberus. The scheme with a key distribution center (KDC), split into an authentication server and a ticket-granting server, works like this: the user once proves knowledge of the password and receives a ticket-granting ticket (TGT), and then by the TGT receives service tickets for specific services — each encrypted with the key of its service and furnished with a timestamp against replays. The password is entered once per session; the services trust the KDC; replays are cut off. The fifth version of the protocol (RFC 1510, 1993; modern profile RFC 4120, 2005) became the basis of authentication in Windows 2000 and remains the core of Active Directory domains to this day — every corporate Windows network is effectively a Kerberos network. It is also attacked in a big way: the "golden ticket" (compromising the master key of the domain gives power over the entire forest), kerberoasting (brute-forcing the hashes of service tickets), version downgrade attacks.

Multi-factor authentication and passkeys

When the password is stolen anyway — by phishing, by running through breaches, by intercepting SMS — the second factor adds strength: something the user has (a phone, a token), or something the user is (biometrics). The effectiveness is measured harshly: by Microsoft's estimate, MFA blocks more than 99.9% of automated attacks on accounts. The classes of the second factor are not equivalent: SMS is intercepted by SIM swapping, push notifications are worn down by MFA fatigue (this is how Uber was taken in 2022), while hardware keys are resistant even to phishing, because the signature is tied to a specific domain.

It is precisely on this principle that the FIDO2/WebAuthn standards are built — a W3C recommendation since March 4, 2019. The private key is created and stored in the secure element of the device and never leaves it; the server stores only the public key; login is a signed cryptographic task tied to the domain, not a reusable secret. Passkeys, announced by Apple, Google, and Microsoft in May 2022, are the same technology with synchronization through the cloud: the key lives in the platform's password manager and moves between devices. Adoption is going rapidly: by May 2026, the FIDO Alliance estimated the number of passkeys in use at five billion, awareness of the technology at 90%, and the share of successful logins via passkey at approximately 36% versus 26% a year earlier. For machine access the paradigm is different: OAuth 2.0 (RFC 6749, 2012) delegates rights without transmitting a password, OpenID Connect adds an identification layer, and JWT tokens (RFC 7519, 2015) carry signed claims — on condition that the developer verifies the algorithm and the signature, and does not take them on faith: JWT verification errors are a classic of API breaches.

The idea uniting OAuth, JWT, and API tokens is older than all of them: capability-based security. Instead of the question "who are you?" the system asks "what are you allowed to do?" — and the carrier of the permission becomes the token itself, an inalienable and non-reworkable ticket for a specific action. The owner of a link to a document in the cloud does not "authorize himself" — he presents a capability; the service does not need to know his identity. Hence both the strength and the weakness of the approach: a leaked token gives exactly the rights that were sewn into it — that is why tokens are made short-lived, narrow-scoped, and revocable, and the model of minimal privileges from corporate networks moves into APIs.

TLS: the protocol that encrypted the Internet

From SSL to TLS 1.3

In 1994, the Netscape team headed by Taher ElGamal designed SSL — a "security socket" between the application and transport levels, so that payments and passwords in the early web would not travel in open text. SSL 2.0 (1995) turned out to be full of holes; SSL 3.0 (1996) was reworked by Alan Freier, Paul Kocher, and Phil Carlton; and in 1999 the IETF standardized its successor — TLS 1.0 (RFC 2246). Then came the versions: TLS 1.1 (2006), TLS 1.2 (2008, RFC 5246) — for many years the main protocol of the Internet — and TLS 1.3 (RFC 8446, August 2018), a radical cleanup: the handshake was accelerated to one round trip (and 0-RTT for repeated sessions), all outdated algorithms were cut out (RSA key exchange, CBC, RC4, SHA-1, all versions below 1.2), only AEAD ciphers were left, and perfect forward secrecy was made mandatory through (EC)DHE. TLS 1.3 encrypts even part of the handshake, including the server's certificate — the eavesdropper does not see which site you are opening, except for the name in SNI (which the developing ECH standard closes).

The handshake in one step

Modern TLS 1.3 looks like this. The client in ClientHello immediately sends the list of supported ciphers, a random number, and — most importantly — its ECDHE parameters (key share), without waiting for the server's response. The server in ServerHello chooses the cipher, sends its half of the ECDHE, its X.509 certificate, and the signature of the exchange parameters with its private key. Both parties independently compute the common secret (ECDHE) and from it — the session keys of AES-GCM or ChaCha20-Poly1305. The client checks the certificate chain up to a trusted root, the domain name, and the validity period; the Finished exchange confirms that both parties see the same handshake — any interference in the middle breaks here. Further, the application data goes in TLS records: each record is encrypted, furnished with a hidden sequence counter (protection against replays) and an authentication tag. The whole scheme is a vivid demonstration of hybrid cryptography: the expensive asymmetric part once, the cheap symmetric part for all the traffic.

Perfect forward secrecy (PFS) deserves a separate word. Without it, the session key was encrypted with the server's public key: steal the server's private key — and all the traffic recorded over the years is decrypted retroactively. With ECDHE, the session secret is born anew every time and does not depend on the server's long-lived key: the compromise of the key does not open past sessions. That is exactly why in TLS 1.3 PFS is mandatory, while in 1.2 it had to be turned on consciously.

The chronicle of falls and lessons

TLS as a protocol is broken rarely — the environment and the old versions are broken. BEAST (September 2011, Duong and Rizzo) exploited the predictable IVs in CBC of TLS 1.0; CRIME (2012) restored cookies from the change in the length of the compressed traffic; POODLE (October 2014, Google) finished off SSL 3.0 through the padding oracle; FREAK and Logjam (March and May 2015) forced servers to downgrade the connection to export 512-bit Diffie-Hellman parameters, a legacy of the crypto wars: Logjam worked against 8.4% of the million largest sites. The most famous is Heartbleed (announced April 7, 2014, CVE-2014-0160): an error in the implementation of the heartbeat extension of OpenSSL allowed reading up to 64 kilobytes of the server's memory — private keys, passwords, sessions. The bug lived in the code for two years; about half a million servers (approximately 17% of SSL hosts) turned out to be vulnerable; and it was found independently by Neel Mehta of Google and the Finnish Codenomicon. Heartbleed became the symbol of the industry's main problem: the critical infrastructure of the Internet rested on a project with a meager budget and a handful of developers; after it, OpenSSL received funding and an audit, and the industry learned the price of "invisible" dependencies.

Configuration errors are no less instructive. RC4 was long considered the salvation from BEAST, until the attacks of 2013 led to its prohibition by the standard RFC 7465 (2015). The mass disabling of old versions dragged on for years. The client side breaks more simply: one line verify=False in the code disables certificate verification — and a MITM with any self-signed certificate reads all the traffic; studies time after time found this pattern in a noticeable share of mobile applications. Another vector is the trust store: if someone else's root CA is installed in the system (a corporate proxy, malware, or the Superfish ad module that Lenovo preinstalled on its laptops in 2015), any forged certificates are accepted silently. The answers were HSTS (RFC 6797, 2012) — a header forbidding the browser to talk to the site over HTTP and killing TLS stripping — and the gradual squeezing of HTTP out of the web.

The state as of 2026

The numbers record the victory of encryption by default: more than 95% of page loads in Chrome go over HTTPS (in developed countries up to 99%); about 87% of all websites have a valid certificate (W3Techs, October 2026); approximately three quarters of the largest sites support TLS 1.3; and by the autumn of 2026 Chrome made the "always secure connection" mode enabled by default. Let's Encrypt issues about ten million certificates per day; HTTP/3 moved TLS 1.3 inside QUIC over UDP, joining encryption with the transport. Over thirty years TLS traveled the path from "exoticism for banks" to an invisible standard: the user of 2026, opening an unprotected HTTP site, receives a browser warning — a complete inversion of the situation of the 1990s, when encryption was the exception.

IPsec and VPN: protection at the IP level

A standard that outran its deployment

While the application level was only trying on encryption, the IETF was preparing protection at the very network level. In August 1995 came out the first set of RFCs on IPsec (1825–1829); in 2005 it was reworked (RFC 4301 and neighbors). The idea is ambitious: security is built into IP itself, is transparent for applications, and works "out of the box" for all traffic. IPsec consists of two protocols: AH (Authentication Header, protocol 51) confirms the integrity and authenticity of the packet but does not encrypt; ESP (Encapsulating Security Payload, protocol 50) encrypts the payload and authenticates it. Two modes: transport — the contents of the packet between the end nodes are protected; tunnel — the entire original packet is wrapped in a new one, and this is how VPNs are built. The keys are managed by IKE (Internet Key Exchange; the modern version IKEv2 — RFC 7296): essentially, the same Diffie-Hellman exchange plus certificates, which makes configuring IPsec a separate engineering discipline.

IPv6 required IPsec as mandatory, and this requirement was later repealed as unfulfilled: the standard turned out to be too flexible — dozens of options, modes, and algorithms gave birth to incompatible implementations and the reputation of "a protocol that cannot be configured the same way twice." The mass Internet chose TLS, and IPsec occupied its niche, where it is irreplaceable: site-to-site VPNs between offices and data centers, protection of backbone channels, corporate remote access.

From PPTP to WireGuard

The history of VPNs for people is a history of the successive abandonment of the broken. PPTP (1996, the Microsoft consortium) allowed office clients to "dial" into the corporate network through the Internet, but by 1998 Bruce Schneier and colleagues had shown the fatal defects of its authentication and encryption; nevertheless PPTP lived in router settings to our days, and disabling it is still recommended. L2TP/IPsec replaced the crypto layer; OpenVPN (James Yonan, 2001) added flexibility on a user-space TLS-like protocol and became the de facto standard of remote access for twenty years.

In 2015–2016, Jason Donenfeld presented WireGuard — the complete opposite of IPsec in philosophy: about four thousand lines of code instead of hundreds of thousands, a fixed modern set of algorithms (Curve25519 for keys, ChaCha20-Poly1305 for encryption, BLAKE2 for hashes), no options that can be misconfigured. Linus Torvalds called it "a work of art" against the background of OpenVPN and IPsec, and in March 2020 WireGuard was included in the Linux kernel. Today it is the standard choice for new VPNs — from corporate mesh networks like Tailscale to the servers of consumer providers.

A separate reality is the consumer VPN services promising anonymity. Technically they give encryption of the "last mile" to the provider's server and the substitution of the visible IP address, but all the traffic after that goes openly to the VPN provider, who sees more than the home operator — studies time after time found DNS leaks, built-in trackers, and logs in mass VPN applications, despite the "no logs" policy. A VPN protects against surveillance in a café and against the provider, but not against the VPN provider itself: the trust does not disappear, it moves.

Zero trust: the VPN leaves the stage

The classic VPN embodies the outdated model of the "castle with a moat": once you are inside the tunnel, you are trusted and you see the whole network. An attack on one remote employee or stolen VPN credentials (this is how many loud breaches began, including Colonial Pipeline) turn the "moat" into the front entrance. The answer is the zero trust architecture: access is given not "to the network," but to a specific application; every request is authenticated and authorized anew, with a check of the state of the device — the VPN disappears as a concept. More about this in the section on network protection.

Wireless networks: from WEP to WPA3

WEP: broken before birth

The Wi-Fi standard 802.11 (1997) promised "security equivalent to a wired network" — WEP, Wired Equivalent Privacy. The promise was not fulfilled in a single letter: WEP used the stream cipher RC4 with a static key and a 24-bit initialization vector, which repeated within hours on a loaded network. In August 2001, Scott Fluhrer, Itsik Mantin, and Adi Shamir published the FMS attack, exploiting the weak keys of RC4: from a sufficient number of packets the key was restored statistically. By the mid-2000s, tools like aircrack-ng automated the break to minutes, and in 2005 the FBI publicly broke WEP in three minutes. Millions of networks were left defenseless: there was nothing with which to update the firmware of the old access points.

The intermediate solution was WPA (2003) with the TKIP protocol — a "patch" over the same hardware; the full-fledged protection became WPA2, approved in the 802.11i standard in June 2004: AES in CCMP mode and an honest handshake with the generation of fresh keys (4-way handshake). WPA2 held the defense for thirteen years, becoming a synonym for "protected Wi-Fi."

KRACK and WPA3

On October 16, 2017, Mathy Vanhoef of KU Leuven presented KRACK (Key Reinstallation Attack): the error turned out to be not in the cipher, but in the very handshake of WPA2 — upon the loss of a packet, the attacker could force the client to reinstall an already used encryption key, zero the nonce, and read the traffic. Practically all implementations of the standard were vulnerable — from Windows and Linux to iPhone and Android; the world saw that a certified protocol checked for years can contain a defect in its core. The patches spread over months, but the lesson remained: formal verification of protocols is not a luxury (later the WPA3 handshake was checked precisely by formal methods, and bypasses were still found).

WPA3, announced by the Wi-Fi Alliance on June 25, 2018, replaced the password handshake with the SAE protocol (Simultaneous Authentication of Equals, "Dragonfly"): a dictionary brute-force over intercepted traffic is impossible, every session receives unique keys (forward secrecy for Wi-Fi), and a protected mode for open networks was added. And almost immediately — April 2019 — Vanhoef together with Eyal Ronen presented Dragonblood: downgrade attacks to WPA2, leaks through side channels, and password recovery in the transition mode. The errors were fixed, the standard ripened, but the moral is of the same nature as with TLS: vulnerabilities live not in the mathematics, but in the protocol states and implementations. By 2026, WPA3 is mandatory for the certification of new devices by the Wi-Fi Alliance; however, in the fleet of equipment the mixed WPA2/WPA3 mode prevails, and corporate networks are moving to WPA3-Enterprise with 802.1X and RADIUS. And a separate eternal threat of the wireless world is the "evil twin": an open access point with the name of your favorite café, which sees all the unencrypted traffic; against it works only ubiquitous TLS and a VPN, but not Wi-Fi itself.

Attacks: reconnaissance, interception, and the man in the middle

The attack surface and the reconnaissance tools

Any attack begins with reconnaissance: the attacker studies the attack surface — everything the system shows the world. Whois and DNS tell about the domains and infrastructure; the Certificate Transparency logs — about the subdomains; the search engines — about the forgotten test benches. The port scanner nmap, written by Gordon Lyon (Fyodor) and first published in the autumn of 1997 in the Phrack magazine, polls hosts and by the responses restores the open ports and the versions of the services — and the version of Apache or nginx is immediately checked against the vulnerability databases. The search engine Shodan (John Matherly, 2009) went further: it continuously scans the entire Internet and indexes the responses of the devices themselves — cameras, routers, industrial controllers with default passwords are available to anyone without any scanning. Protection against reconnaissance is partial: minimizing open ports, hiding versions, geoblocking of admin panels — but it is impossible to completely hide a server in the public Internet, and the security model must proceed from the fact that the attacker knows the topology.

Traffic interception: from the hub to ARP spoofing

It is easiest to read other people's traffic where the medium is shared. In the era of hubs, every port saw every packet, and a sniffer — a program in promiscuous mode — collected the passwords of telnet, FTP, and SMTP directly; the analyzer Ethereal (Gerald Combs, 1998), which became Wireshark in 2006, was born precisely out of this practice. Switched networks send a frame only to the recipient — but the ARP protocol, translating IP into MAC addresses, still believes any response without authentication. ARP spoofing: the attacker broadcasts fake ARP responses "the gateway's IP is my MAC," and the victims' machines direct all external traffic through him. DHCP spoofing and rogue routers work the same way. Inside IPv6, the neighbor discovery messages play the same role. Steven Bellovin described these and dozens of other fundamental holes of TCP/IP back in 1989 in the article "Security Problems in the TCP/IP Protocol Suite" — long before they became a mass tool.

The classic of interception is the hijacking of a TCP session. At Christmas 1994, Kevin Mitnick used the predictability of TCP sequence numbers to forge packets on behalf of a trusted host and log into the computer of Tsutomu Shimomura — the hunt for Mitnick ended with his arrest on February 15, 1995, and the book "Takedown" (2002). Today the sequence numbers are cryptographically strong, but the very idea lives on in RST injections: a forged packet with the right numbers tears the connection — a technique that censorship systems, including the Great Firewall, applied for years to break "undesirable" connections.

DNS spoofing and its treatment

The weakest link of naming is the absence of authentication of DNS responses. Having substituted the resolver's response, the attacker sends the victim to a fake bank server instead of the real one. In July 2008, Dan Kaminsky showed that cache poisoning is much more practical than was thought: by picking the 16-bit transaction identifier with a birthday attack in thousands of requests, one can substitute the record of a domain entirely — including the addresses of the root servers. The industry urgently released a coordinated patch (randomization of the source port) at a special meeting at Microsoft's headquarters, and Kaminsky refused to publish the details for half a year. The long-term answer was DNSSEC (RFC 4033–4035, 2005): zone signatures and the chain of trust from the root (signed in July 2010) to the domains (.com — in 2011); the minus is that signatures do not protect against peeking, and the deployment dragged on: in 2026, validation is passed by tens of percent of the world's resolvers. Privacy was closed by other mechanisms: DNS-over-TLS (RFC 7858, 2016) and DNS-over-HTTPS (RFC 8484, 2018), which Firefox and Chrome enable by default — requests to sites no longer travel in open text to the provider.

The man in the middle against TLS

MITM is the universal scheme: the attacker wedges in between the client and the server, reading and modifying the traffic, while each party is sure it is talking to the other directly. Against bare HTTP, all the interception techniques listed above work. Against TLS, the classic MITM is impossible without one of three conditions: the victim accepts a forged certificate (an installed alien root CA, disabled verification, a deceived user), or the server signs a genuine certificate for the attacker (a compromised CA — the DigiNotar case), or TLS stripping is used. The last is the invention of Moxie Marlinspike of 2009 (sslstrip): the proxy accepts from the client an ordinary HTTP request, itself goes to the site over HTTPS, and gives the victim the unencrypted response, having downgraded the connection before HSTS had time to work. The defensive complex has been worked out: HSTS (including the browsers' preload list), strict certificate verification, Certificate Transparency making a forged issuance visible, and pinning in mobile applications. In 2026, MITM against TLS is no longer a mass technique, but a targeted operation against trust: either social, or state, or through a compromised PKI.

A separate class of attacks requires neither interception nor forgery — replay. An attacker who has recorded a legitimate encrypted packet can send it again: open the door with someone else's key pass, debit the money again, vote twice. The antidote is the same in all protocols: freshness. One-time random numbers (nonce), timestamps with an admissible window, sequence counters — everything that makes a recorded packet unfit for reuse. TLS numbers the records with a hidden counter and tears the connection on a permutation; Kerberos furnishes the tickets with timestamps; IPsec keeps an anti-replay window of numbers; in web applications, CSRF tokens and one-time payment codes play the same role. The rule of protocol design: any step that can be repeated with profit must contain an element of freshness.

DoS and DDoS: the war of attrition

The mechanics of denial

The goal of DoS is not to steal, but to break: to make the service unavailable. The most ancient technique is SYN flood: the attacker sends thousands of SYN requests from fake addresses; the server reserves memory for the half-connections; the queue overflows, and the legitimate clients do not get through. The medicine was invented by Daniel Bernstein in 1996 — SYN cookies: the state of the connection is encoded cryptographically in the very sequence number of the SYN-ACK; the server stores nothing until the final ACK. UDP and ICMP floods strike at the bandwidth; smurf used broadcast ICMP echoes with the victim's fake address — until they were banned. A special class is reflection and amplification: a small request with the victim's forged address causes a huge response from a third party. The amplification factor of a DNS request is tens; of the NTP monlist command — 556; and memcached in 2018 gave a record 51,000:1 — this is exactly how on February 28, 2018, GitHub survived an attack of 1.35 Tbit/s, and a day later another victim received 1.7 Tbit/s. L7 attacks are more sophisticated: HTTP flood looks like ordinary requests; Slowloris (Robert Hansen, 2009) keeps the connections open, slowly finishing the headers; CVE-2023-44487 "HTTP/2 Rapid Reset" (October 2023) used the instant cancellation of streams — this is how Google in August 2023 repelled an attack of 398 million requests per second, tenfold exceeding the previous records.

From Mirai to the terabit era

DDoS is the distributed version, striking from thousands of machines at once. Industrialization was provided by botnets of IoT: in September 2016, the journalist Brian Krebs survived 620 Gbit/s from Mirai — a worm that ran through the standard passwords of webcams and routers; on October 21, 2016, Mirai struck the DNS provider Dyn, and half of America for hours lost Twitter, Reddit, Netflix, and CNN. The authors — three students from Rutgers — at the end of September 2016 posted the worm's sources on a hacker forum, and since then Mirai clones became a commodity. The chronicle of records speaks for itself: 300 Gbit/s against Spamhaus (March 2013, DNS amplification), 1.7 Tbit/s (memcached, 2018), 5.6 Tbit/s (Cloudflare, October 2024), 7.3 Tbit/s (May 2025), 29.7 Tbit/s (September 2025, the Aisuru botnet), and finally 31.4 Tbit/s in the fourth quarter of 2025 — the attack of the Kimwolf botnet, assembled from more than 1.8 million infected Android devices, mostly TV set-top boxes without security updates; in the same weeks Cloudflare also repelled HTTP attacks of over 200 million requests per second. In the second quarter of 2026 there were already more than eight hundred attacks more powerful than 1 Tbit/s — 519% more than a year earlier: terabit traffic became routine.

Protection and economics

The protection is built on distribution: anycast networks like Cloudflare, Akamai, and Google scatter the attack across hundreds of points of presence, where the traffic passes through scrubbing — automatic filtering of anomalies, fingerprinting of botnets, and rate limiting. For L7 attacks, WAFs, bot checks, and behavioral analysis are added. The reverse side is the economics: renting a botnet for an hour-long attack on the black market costs tens of dollars, and "stresser services" sell DDoS as a service; the FBI and Europol with regular operations (Operation Power Off) close the largest platforms, but new ones take their place. DDoS remains the cheapest and most accessible digital cudgel — from extortion of small businesses to geopolitics: at the peak of the tensions of 2022–2026, attacks on government sites and banks became the background noise of conflicts. The problem is never solved completely: the source of the traffic is other people's infected devices, and the victim is obliged to be available. Asymmetry in pure form: the cost of the attack falls, the cost of filtering grows.

Malicious programs: from Creeper to extortionists

Thirty years of evolution

The first self-replicating network program was Creeper (1971, Bob Thomas, BBN): it hopped between DEC mainframes in ARPANET, printing on the teletype "I'm the creeper, catch me if you can!" — and against it Reaper was written, the first antivirus program. The first virus for the IBM PC, Brain (1986), was composed by the Pakistani Alvi brothers to protect their medical software from piracy. The epidemics of 2000–2004 — ILOVEYOU, Code Red (July 2001; 359 thousand infected IIS servers in fourteen hours), Nimda, Slammer, MyDoom — showed the speed of spread in a fully connected world; Conficker (2008–2009) infected, by various estimates, up to fifteen million machines and forced Microsoft to announce a reward of 250 thousand dollars and to assemble a working group of competitors.

Stuxnet (discovered in June 2010) moved malicious programs into another weight category: the worm carried four zero-day exploits of Windows, two for the Siemens software, three stolen digital signatures of driver manufacturers, and targeted the controllers of the centrifuges of the Iranian uranium enrichment plant at Natanz. About a thousand centrifuges failed; the operation is attributed to the USA and Israel (the "Olympic Games" program). For the first time code crossed the border between bits and the physical world, and a worm signed with stolen certificates vividly showed the vulnerability of PKI.

The era of extortionists

CryptoLocker (September 2013) invented the business model: encrypting the victim's files with a demand for a ransom in bitcoins. CryptoLocker had enough followers, but the real era began on May 12, 2017, with WannaCry: the worm used the EternalBlue exploit to SMB — an NSA tool stolen and published by the Shadow Brokers group a month earlier — and in a day hit 230 thousand computers in 150 countries. Deutsche Bahn, Telefonica, Renault, and the British NHS suffered: about eighty of the 236 hospital trusts, thousands of canceled operations, a loss of around 92 million pounds; the Microsoft patch had come out back in March, but it had not been installed. The spread was stopped by the 22-year-old researcher Marcus Hutchins, who registered for 10.69 dollars the "kill switch" domain sewn into the worm. The attribution is Lazarus, North Korea (officially — the USA, December 2017).

Six weeks later, NotPetya (June 27, 2017) disguised itself as an extortionist while being a pure machine of destruction: having penetrated through the update of the Ukrainian accounting program M.E.Doc, it in hours paralyzed Maersk (4 thousand servers, 45 thousand computers), Merck, FedEx, and the Chernobyl nuclear plant, where dosimetry had to be measured by hand. The total damage is estimated at over 10 billion dollars — the most expensive cyberattack in history; the USA and its allies publicly placed the responsibility on the Russian military intelligence, and in October 2020 the US Department of Justice brought charges against six officers of unit 74455.

By the 2020s, extortionists had turned into a corporate industry with the RaaS model (ransomware-as-a-service), double extortion (encryption plus the threat of publishing what was stolen), and an affiliate scheme, where the developer shares the revenue with the executors. Colonial Pipeline (May 7, 2021, the DarkSide group): the stoppage of the 5500-mile pipeline providing 45% of the fuel of the East Coast of the USA, panic at the gas stations, a ransom of 4.4 million dollars in bitcoins — of which the FBI returned 63.7 BTC, having gained access to the wallet. Change Healthcare (February 2024, BlackCat/ALPHV): entry through a Citrix portal without MFA paralyzed pharmacy settlements across the whole USA for weeks; UnitedHealth paid a ransom of 22 million; up to 190 million Americans were affected; the corporation's total losses exceeded 3 billion dollars. MOVEit (May–June 2023, Cl0p): a zero-day SQL injection in the file exchanger gave 2700 organizations and over 90 million people as victims. In 2025, a wave passed over British retail: Marks & Spencer lost about 300 million pounds of profit after social engineering against a third-party support service (the Scattered Spider affiliates); the Co-op network was left without part of its supplies; in August 2025, Jaguar Land Rover stopped for five weeks — economists estimated the effect for the British economy at up to 1.9 billion pounds; in September, an attack on the Collins Aerospace MUSE software disrupted the check-in of passengers at Heathrow, Brussels, and Berlin. The statistics record the industrialization: according to Black Kite, in 2025, 7551 organizations appeared on the extortionists' leak sites — a quarter more than a year earlier; the Verizon DBIR 2026 places extortion schemes in almost half of all incidents; and Sophos counts that encryption succeeds in approximately 56% of attacks — the defense has learned to thwart more often, but the attackers have moved to pure extortion with data theft, without encryption at all.

The supply chain: trust as a vector

The most effective attacks of the last decade struck not at the victim, but at its suppliers. SolarWinds (discovered by FireEye on December 8, 2020): into the updates of the Orion platform, used by 18 thousand organizations including nine US federal agencies, a trojan SUNBURST with a "sleep period" was sewn; the operation was attributed to the Russian SVR. Log4Shell (December 2021, CVE-2021-44228, CVSS score 10.0): the tiny logging library Log4j, built into hundreds of millions of devices — from Minecraft to banking software — executed remote code because of JNDI substitution in a log line; the vulnerability was reported to Apache on November 24 by the Alibaba Cloud researcher Chen Zhaojun; exploitation began even before the public announcement; Tenable called it the most large-scale vulnerability of the decade. And xz-utils (March 29, 2024, CVE-2024-3094): the Microsoft engineer Andres Freund, investigating a half-second delay of SSH login, discovered a backdoor in the liblzma archiver, which for two years had been planted by a character who had established himself in the community, "Jia Tan," with a network of fake accounts pressuring the exhausted maintainer. The backdoor gave remote access to sshd on the test builds of Fedora and Debian — it was stopped one step from the stable releases of practically the entire Linux infrastructure of the Internet. The lesson of all three stories is the same: in a world where any program is assembled from thousands of other people's components, trust in a dependency is also a vector of attack, and repositories, updates, and CI/CD require the same protection as the perimeter. Hence also the new category of the OWASP Top 10 2025 — Software Supply Chain Failures.

Network protection: perimeter, segmentation, and zero trust

Three generations of firewalls

The first generation is the packet filters of the late 1980s: routers checking every packet against a table of rules (addresses, ports, protocols). They worked fast, but did not remember the context: a packet belonging to an established connection differed from a new one only by the TCP flags, and the rules quickly turned into an unreadable bedsheet. Bill Cheswick and Steve Bellovin at AT&T systematized the practice — their book "Firewalls and Internet Security" (1994) became the first textbook of the industry. The second generation added state (stateful inspection): DEC SEAL by Marcus Ranum (1992) and especially Check Point FW-1 by Gil Shwed (1993; the patent on stateful filtering) tracked the connection table — "response traffic is allowed automatically" became the norm, and the firewall stopped being a filter, becoming a session dispatcher. The third generation is the application-level gateway and proxies, dissecting the protocols down to the contents, and since the late 2000s — NGFW (Palo Alto Networks, 2007): identification of applications regardless of the port, integration with IPS, and filtering by users. In the Linux world, iptables (2001, the netfilter subsystem) and its successor nftables became the standard; in the cloud, security groups play the same role — stateful filters tied to the virtual machine from the first day of EC2 (2006).

The honest limitation: the firewall does not protect against what passes through the allowed ports — against web attacks, phishing, malicious attachments. It narrows the attack surface, but does not replace the protection of applications and people.

IDS, IPS, and segmentation

Intrusion detection systems grew out of James Anderson's work for the NSA (1980) and Dorothy Denning's model (1987): analysis of the audit for anomalies and signatures. Gene Kim with Eugene Spafford wrote Tripwire (1987) — file integrity control; Martin Roesch in 1998 released Snort — an open-source network IDS with a signature language, which became the industry standard (Sourcefire, bought by Cisco in 2013 for 2.7 billion dollars); since 2009 the Open Information Security Foundation has been developing Suricata with multithreading. IPS is the same analysis, but with blocking in real time; the price is false positives tearing legitimate traffic. The modern heirs are EDR/XDR: agents on the endpoints with behavioral telemetry; it is they that today catch lateral movement, which the classic IDSs miss.

Segmentation is the second pillar of internal protection: VLANs, subnets, and microsegmentation divide the network so that the breach of a web server does not open the road to accounting and to the domain controller. The DMZ carries the public services outside the internal perimeter; bastion hosts give the single controlled point of entry for administrators. The value of segmentation is measured not in prevented intrusions, but in the cost of lateral movement: NotPetya mowed down Maersk entirely precisely because the flat corporate network knew no internal boundaries.

Zero trust: the end of the perimeter

The "castle with a moat" model died together with the clouds, remote work, and mobile devices: "inside" and "outside" are no longer defined. The concept of zero trust was formulated by John Kindervag of Forrester in 2010 in a report with the characteristic title "No More Chewy Centers": trust nothing by default, verify every request, proceed from the fact that the network is already compromised. The most large-scale implementation was done by Google: after the Chinese operation Aurora (2009), the company built BeyondCorp — employee access to applications without a VPN, through a gateway with the constant rechecking of the identity, the device, and the context of every request (the series of articles of 2014–2017). In August 2020, NIST released SP 800-207 — the reference architecture of zero trust; in the USA its adoption became a requirement for federal agencies after the executive order of 2021, and CISA publishes a maturity model. The principles are simple and ruthless to legacy: minimal privileges per request, authentication of the device on a par with the user, microsegmentation, telemetry of everything, implicit denial by default. Zero trust is not a product, but a ten-year restructuring of the architecture, but the direction is irreversible: the perimeter has dissolved, and every session has become a border.

Web security: the application front

OWASP Top 10: the map of threats

The application level is attacked not with cryptography, but with logic. The map of threats is the OWASP Top 10 list, published since 2003; the fresh edition was presented on November 6, 2025, at Global AppSec and recorded the shift of the industry: the first place has for many years been held by Broken Access Control — errors of rights delineation, into which SSRF has now been poured; the second is Security Misconfiguration; the third was taken by the new category Software Supply Chain Failures; after them come Cryptographic Failures, Injection, Insecure Design, Authentication Failures, Software or Data Integrity Failures, Logging & Alerting Failures, and the second new category — Mishandling of Exceptional Conditions. It is telling what is no longer in the list as a separate line: over twenty years the industry has mostly learned not to concatenate SQL and to escape the output — basic injections are a thing of the past, giving way to errors of architecture, rights, and dependencies.

The classics of the genre and their treatment

SQL injection — the substitution of code into a query through user input — was first publicly described in 1998 and is still encountered in the wild: thus in 2017 Equifax lost the data of 147.9 million Americans through an uninstalled Apache Struts patch, subsequently paying 700 million under a settlement agreement. The treatment is trivially known: parameterized queries and ORMs, the principle of least privilege for the database account. XSS — the injection of a script into a page — was made famous by the Samy worm on MySpace (October 2005): in twenty hours it gathered a million "friends"; the protection is contextual escaping, Content Security Policy, the HttpOnly and SameSite cookie flags. CSRF — forcing a logged-in user to perform an action on someone else's site — is neutralized by tokens and the SameSite attribute, which Chrome has set by default since 2020. SSRF — forced requests of the server to internal resources — was made famous by the Capital One breach (July 2019): a misconfigured WAF allowed, through the EC2 metadata, taking the IAM role and carrying out the data of 106 million clients; cloud metadata (169.254.169.254) since then is the first thing pentesters check.

A separate epidemic is secrets in the code: API keys, tokens, and passwords committed to public repositories; GitGuardian counts their leaks in millions per year, and secret scanners are built into the CI of all the major platforms. To the same category — debug mode in production, admin panels without rate limiting, default passwords of panels, open S3 buckets: a significant part of the "loud leaks" is not a hack, but a find. The set of hygienic headers and settings has long been canonized: HSTS, CSP, X-Content-Type-Options, Referrer-Policy, Secure/HttpOnly/SameSite for cookies, Subresource Integrity for third-party scripts, mandatory verification of the signature of incoming webhooks, rate limiting, and alerts on anomalies. Boring — but it is precisely boring hygiene that closes most of the holes through which people really enter.

Privacy: encryption is not yet anonymity

Metadata and traffic analysis

Even perfect TLS hides the content, but leaves the metadata: who connects, when, for how long, how many bytes. Traffic analysis is the oldest intelligence technique, which survived encryption: by the volume and rhythm of the connections, specialists restore what the user is doing — watching video, calling, or trading; and by the SNI in the unencrypted ClientHello the domains were long visible too (the problem is being closed by Encrypted Client Hello, deployed by Cloudflare and the browsers). The old rule of intelligence says: what matters is not what is written in the letter, but who writes to whom, when, and how often. The new level is machine learning on the shapes of traffic: studies show the possibility of classifying sites and applications by the statistics of the packets even inside TLS. Hence the main conclusion of the section: the confidentiality of the content and the privacy of the behavior are different properties, and the second is not solved by cryptography.

Mix networks and Tor

The answer to traffic analysis became David Chaum's mix networks — the article "Untraceable Electronic Mail" (1981) proposed passing the messages through a chain of nodes, each of which knows only the previous and the next one. The idea grew into onion routing: in the mid-1990s, Paul Syverson, Michael Reed, and David Goldschlag of the US Naval Research Laboratory designed the scheme to protect intelligence traffic, and in 2002 Syverson with Roger Dingledine and Nick Mathewson launched Tor; since 2004 the project was funded by the EFF; since 2006 it is independent. The client builds a chain of three nodes, encrypting the packets in layers, like an onion: none of the nodes sees simultaneously the sender and the content; the exit node knows the destination, but not the source. By 2026, the network is used by about three million people a day through roughly nine thousand volunteer relays; the largest consumer of bridges and censorship circumventions is Russia. Tor proved the fundamental possibility of anonymity for everyone at once: journalists, dissidents — and criminals simultaneously; the closure of Silk Road in October 2013 (Ross Ulbricht, a life sentence replaced by a pardon in January 2025) did not destroy the shadow markets, but neither did it cancel the value of Tor for those for whom anonymity is a question of life. Full anonymity is fragile: application errors, unique browser parameters, and behavioral patterns deanonymize faster than cryptography is broken.

End-to-end encryption and the "going dark" dispute

End-to-end encryption (E2EE) moves the cryptography to the ends: the service provider physically cannot read the messages. The de facto standard is Moxie Marlinspike's Signal Protocol with the Double Ratchet mechanism, changing the keys for every message; in April 2016 WhatsApp enabled it for a billion users; similar schemes work in iMessage (with Advanced Data Protection for backups since December 2022), in Google Messages, and partly in Telegram. E2EE closes the content from everyone, including the service itself — and that is why for thirty years the dispute about "going dark" has been going on: in February–March 2016 the FBI litigated with Apple, demanding to open the iPhone of the San Bernardino shooter, and withdrew the suit, having paid external contractors about 1.3 million dollars for the unlocking; Britain in the Online Safety Act of 2023 and Australia in 2018 adopted laws obliging to "assist" the intelligence services; in the EU the idea of "chat control" periodically surfaces. Cryptographers invariably answer: weakening E2EE for the chosen is a backdoor for everyone, and client-side scanning (Apple renounced it in 2021 under the pressure of the community) contradicts the very idea of end-to-end encryption. By 2026 the dispute is not resolved in either direction: E2EE stands, the laws accumulate, and privacy has finally become a political, not only technical, property of protocols.

The economics of security and the human factor

The price of a breach and the price of protection

Security is a market with measurable prices. Cybersecurity Ventures estimates the total damage of cybercrime at 10.5 trillion dollars for 2025, with a forecast of 12.2 trillion by 2031 — more than the turnover of the world drug business and a third of the US GDP. The price of a single incident is growing: the average cost of a breach in the world reached 4.99 million dollars — a record and plus 12% over the year (IBM, July 2026); in the USA it is more than twice the world figure. A new line of expense is artificial intelligence: every fourth malicious intrusion of 2026 uses AI (a growth of 56% over the year) and costs on average 6 million dollars, while organizations with "shadow AI" — the uncontrolled use by employees of external models — pay on average 5.39 million versus 4.99. There are also more victims: by the count of ITRC, in the first half of 2026 alone, 1803 compromises and 471.2 million victim notifications were recorded in the USA — already more than in all of 2025.

The surplus of demand gives birth to a shortage of personnel. According to the ISC2 study of 2024, 5.5 million specialists worked in the industry with a gap of 4.8 million — the largest in the history of observations; in 2025 ISC2 refused to publish an estimate of the gap, since the practices more important than quantity became the shortage of specific skills: incident response, cloud security, engineering. The industry answers with automation (SOCs on AI agents), outsourcing to MSSPs, and — from the other side of the barricades — bug bounties: the reward programs of Google, Microsoft, Apple, and platforms like HackerOne have paid researchers hundreds of millions of dollars in total, turning the "white" hunt for vulnerabilities into a profession. The norms of vulnerability disclosure (coordinated disclosure), the CVE catalog (MITRE, 1999), the CVSS scale, and the catalog of exploited vulnerabilities of CISA are the infrastructure that made the market of information about holes relatively civilized.

The human as a vector of attack

The main target of the modern attack is not the cipher and not the firewall, but the human. The Verizon DBIR 2026 records the human element in 62% of breaches; social engineering is the third most common scheme (16%), and telephone pretexting grew by 40% over the year. The textbook example is MGM Resorts, September 2023: the attackers found an employee on LinkedIn, called the support service on his behalf, received an account reset — and in ten days of downtime the casino lost about 100 million dollars. The same Scattered Spider scheme in 2025 formed the basis of the attacks on Marks & Spencer, Co-op, and Jaguar Land Rover. The FBI (IC3) estimates the losses of Americans for 2024 at 16.6 billion dollars, of which business phishing and BEC — 2.8 billion. The legacy of Kevin Mitnick — from the hacker arrested in 1995 to the consultant who died in July 2023 — reduces to the formula: "a human is cheaper to hack than a system." The industry's answer has shifted from briefings to architecture: FIDO keys and passkeys, which cannot be handed over by phone because they are tied to the domain; phishing simulations without punishments; minimal privileges, under which the compromise of an employee is not equal to the compromise of the network. And the paradox of the economics: security still pays for the boring — patches, MFA, segmentation, backups — while hacking pays for the exception.

The quantum threat and the future of cryptography

Harvest now, decrypt later

In 1994, Peter Shor showed: a quantum computer of sufficient power solves the factorization and discrete logarithm problems in polynomial time — that is, it breaks RSA, Diffie-Hellman, and elliptic curves all at once. The practical question is not "if," but "when": machines on hundreds of qubits exist (Google Willow, December 2024, for the first time demonstrated the reduction of errors when scaling); to the cryptographically significant millions of stable qubits — by the estimates of the industry, from five to fifteen years. The danger is that one cannot wait: adversaries are already today recording the intercepted encrypted traffic counting on decrypting it later — harvest now, decrypt later. The Belgian state security in 2022 directly accused Chinese APTs of collecting the encrypted data of government networks precisely with such a calculation; for data with a secrecy of ten years and more (medicine, state secrets, personal data), the threat is already actual.

Post-quantum cryptography

NIST launched the contest of post-quantum algorithms in December 2016, announced the winners in July 2022, and on August 13, 2024, approved the first standards: FIPS 203 (ML-KEM, lattice-based key exchange, also known as CRYSTALS-Kyber), FIPS 204 (ML-DSA, signatures, CRYSTALS-Dilithium), and FIPS 205 (SLH-DSA, conservative hash-based signatures). The deployment is going faster than any cryptographic transition in history: the hybrid suite X25519MLKEM768 — a classic curve plus a lattice, so as not to depend on one new algorithm — Chrome enabled by default in 2024; Cloudflare deployed it on its network; by 2026, more than half of web traffic is protected by post-quantum key exchange — from approximately two percent in two years. The NSA in the CNSA 2.0 profile requires the US national security systems to move to PQC by 2030–2035; the migration of enterprises is measured by the same decade — hindered by the sizes of post-quantum signatures (several times larger than RSA), the load on the PKI, and devices that will never be updated. The key property being laid down today is cryptographic agility: the ability to change the algorithm by configuration, not by rewriting the protocol. TLS 1.3 has already changed the key exchange algorithm without a single release of "TLS 2.0" — and this is the best argument that agility is designed in advance. The history of security teaches: algorithms survive decades, implementations — years, and systems not designed for the replacement of cryptography survive nothing.

The path of one intrusion: putting it all together

Let us trace a typical attack scenario on a hypothetical company — from the first letter to the incident report — and see how each dissected mechanism works in practice. All coincidences with real incidents are intentional: the scenario is assembled from the materials of Verizon, CISA, and the analyses of the attacks of 2023–2025.

The attack begins with reconnaissance. An affiliate of a ransomware group studies the surface: Shodan shows the company's VPN gateway; the Certificate Transparency logs — the subdomains and a test bench; LinkedIn — the employees of the IT department; Whois — the domain registrar. The target is composed: not "hack the company," but a specific account with administrator rights. Next comes social engineering: phishing of an employee of a contractor's support service or a direct call to the help desk with the request "reset the MFA, I lost my phone" (the Scattered Spider scheme). The letter passes the spam filters: the twin domain is fresh; the sender has its own legitimate SPF and DKIM — DMARC does not save you from a look-alike domain, and the user sees the familiar design of the portal. If there is no MFA or it is a push notification that can be "fatigued," the account falls; if the employee works with a FIDO2 key tied to the domain — the attack dies at this step, and the attacker goes to look for another entrance.

Let us suppose the worst case: access is obtained. Here the defense in depth switches on. A login from an unfamiliar device in an unusual geography should raise an IdP alert; conditional access — demand an additional factor or block; the EDR on the workstation — notice the attempt to dump the credentials from LSASS. But let us suppose the SOC is swamped with false positives and the episode drowned in the noise. The attacker consolidates: registers his own "trusted" device, turns on mail forwarding, creates an OAuth application with permanent access — modern techniques work in the identity cloud, leaving no files on the disk. The lateral movement begins: enumeration of the Active Directory groups, kerberoasting of the service accounts, searching for unclosed shares, access to the backup server. Segmentation decides the outcome: in a flat network the path from the mailbox to the domain controller takes days (this was the case in NotPetya and Change Healthcare); in a segmented one — it runs into the firewalls between the zones, the microsegmentation, and the prohibition of horizontal movements for ordinary accounts.

The climax is achieving the goal. The data is collected into an archive and prepared for exfiltration: the classic way is through allowed cloud storages or DNS tunnels, so as not to raise the DLP alerts. If the protection worked at least partially, the scenario degenerates into pure extortion without encryption — the trend of 2024–2026: what was stolen is enough to sell or to threaten with publication. In parallel, the second line of attack is DDoS as a distracting maneuver or as a punishment for refusing to pay: renting a botnet costs less than one hour of downtime of production, as Jaguar Land Rover and Collins Aerospace showed. And here too everything is from the previous sections: the provider's anycast scrubbing, rate limiting at the WAF — or a paralyzed passenger check-in, if the protection of the perimeter was designed "for quiet times."

The finale is detection and response. In the best case, the attacker was noticed not by a human, but by behavioral analytics: an anomalous volume of reading from the file server at three in the morning. Further the runbook works: isolation of the hosts, revocation of the tokens and sessions, rotation of the secrets (including the TLS keys and certificates — a compromised private key of the server requires immediate reissuance through ACME), preservation of the images for forensics, the legal contour — notification of the regulators and the victims within the terms of GDPR and local laws. The post-mortem returns us to the beginning of the article: almost every loud incident is parsed into the same few failures — the absence of MFA on a critical portal, a flat network, untracked secrets, ignored alerts, uninstalled patches. Not one of them requires the attacker to break the cryptography: AES and ECDHE have not fallen once — people, configurations, and processes have fallen. That is exactly why security is a system, not an algorithm.

Conclusions

Network security is the only theme that passes through all the levels: from the Ethernet frame with its trusting ARP to the policy of the regulators around end-to-end encryption. Everything dissected fits into several through-lines.

The first line — trust as the foundation. The Internet was designed without locks, and every protection mechanism is a way to reintroduce trust into an environment where there is none: the certificate confirms identity, the signature — authorship, PKI delegates trust to institutions, Kerberos — to a center, a passkey — to the device in the owner's hands. Trust is transitive and therefore fragile: the history of DigiNotar, Comodo, and Symantec showed that the compromise of one center puts everyone at risk — and the industry answered with transparency (CT), limitation of authority (CAA), short-lived certificates, and the automation of Let's Encrypt. The question "whom do we trust, and what if that trust breaks" is the main question of any security protocol.

The second line — the mathematics is reliable, the implementations are not. In forty years, neither AES, nor RSA of sufficient length, nor elliptic curves have been broken — the implementations and the environment broke: Heartbleed (a bounds-checking error in OpenSSL), the weak random number generator in Debian, Sony's constant instead of a nonce, ROCA in the Infineon chips, the disabled certificate verification in mobile clients. The hybrid scheme — the expensive asymmetric part for the handshake, the cheap symmetric part for the traffic, PFS against the "record for later" — became the canon of TLS, IPsec, and WireGuard. And this canon is already being rewritten: the post-quantum lattice algorithms are being deployed as hybrids — more than half of the web traffic of 2026 is protected by X25519MLKEM768 — because harvest now, decrypt later makes the migration urgent long before the appearance of the quantum computer.

The third line — a race without a finish. Every generation of protection gives birth to a new generation of attacks: BEAST, CRIME, POODLE, FREAK, Logjam against the old modes of TLS; KRACK against the WPA2 handshake; Dragonblood against the freshest WPA3; Log4Shell against a logging library; the backdoor in xz — against the very process of open-source development. The asymmetry is invariable: the defender must close all the links of the chain; the attacker needs one. Therefore the modern doctrine is not "do not let them in," but defense in depth with the presumption of compromise: segmentation, minimal privileges, behavioral monitoring, fast patches, and crypto agility as insurance against an unknown future.

The fourth line — attacks became an industry. From the loners of the 1980s–1990s (Stoll, Morris, Mitnick) through the worms of the 2000s (Slammer, MyDoom) to state operations (Stuxnet, NotPetya, SolarWinds) and corporate extortionists with the RaaS model, affiliates, and technical support for the victims. The DDoS records grew from 300 Gbit/s (Spamhaus, 2013) to 31.4 Tbit/s (Kimwolf, 2025) — terabit attacks from infected TV set-top boxes became routine, and the number of attacks more powerful than a terabit per quarter grew sixfold. The damage is measured in trillions per year (10.5 trillion for 2025), the average breach — in almost five million dollars, and an attack on a single plant or hospital stops whole industries: from the gas stations of the East Coast of the USA to the flights from Heathrow.

The fifth line — the human remains the main vector. DBIR 2026: 62% of incidents with a human element; telephone social engineering grows by 40% a year; the password "123456" is still first in the world rankings; and MGM, Marks & Spencer, and Change Healthcare fell not through cryptography, but through the help desk. The answer is architectural: FIDO2 and passkeys (five billion keys, 36% of successful logins), which cannot be lured out by a phone call; phishing simulations; privacy by default — E2EE in messengers, DoH in browsers, a minimum of metadata. Cryptography protects the channels, but the behavior of people is protected only by mechanisms that do not require vigilance from people.

The sixth line — security became a property of the whole system. Zero trust dissolves the perimeter: every request is authenticated anew, every device is checked, every access is granted for a task. The supply chain turned into an independent front — the OWASP Top 10 2025 fixed this with a new category, and SolarWinds, Log4Shell, and xz showed the price of the blind spots in the dependencies. Privacy separated from encryption: Tor, ECH, and the "going dark" disputes are no longer about the content, but about the metadata and about the right to anonymity as such. From Stoll's seventy-five cents in 1986 to the five billion passkeys and the post-quantum TLS of 2026, the path of security is the path of the Internet from a club of like-minded people to an environment where trust is not assumed, but is proved by mathematics, protocols, and processes every day, anew, at every request. The race will never end: in this lies its meaning and in this — the price of an open network that is worth protecting.