As noted in our discussion of the creation of the first worm and the first antivirus, cybersecurity was initially designed as a response to a cyber threat. Legacy systems were built to secure organizations from known threats. After the discovery of a cyber threat, security experts would learn its unique execution or coding patterns. This information would be used to enable security systems to detect and stop the identified cyber threat. This tradition still continues up to the present day. There is a famed database known as Common Vulnerabilities and Exposures (CVE), where all the discovered threats are explained and a unique identification number is given to them.

Hackers in the early 2000s began experimenting with many security evasion tactics to beat the existing security tools. They had already come up with techniques to evade security tools on networks. They had also come up with a new attack method called a buffer overflow. A buffer overflow is conducted mostly on client/server apps, where payloads are delivered with data specifically aimed to fill and write outside memory buffers. For instance, hackers would supply scripts to log in input fields in a client app, which would cause the server to import files. Since the server would be expecting just a few characters in the input field, the excess data would cause a buffer overflow, causing it to fail or function erroneously. Exploit toolkits were also being modified to include security evasion tactics.

The cybersecurity industry was under immense pressure to move from signature-based detection techniques to other, more efficient alternatives. The old ways of hardening the security infrastructures in organizations increasingly failed. Despite having many layers of security, organizations were still being breached. Zero-day vulnerabilities and social engineering were major contributors to these attacks. The cost of cyber attacks also increased. In 2018, IBM published that the global average cost of a cyber attack was $3,860,000 USD. This cost factored in expenses such as lawsuits and loss of customers.

Finally, cybersecurity tools got a major...

AI and ML present a new dawn in the cybersecurity industry. AI is not a new concept to computing. It was defined in 1956 as the ability of computers to perform tasks that were characteristic of human intelligence. Such tasks included learning, making decisions, solving problems, and understanding and recognizing speech. ML is a broad term referring to the ability of computers to acquire new knowledge without human intervention. ML is a subset of AI and can take many forms, such as deep learning, reinforcement learning, and Bayesian networks. AI is poised to disrupt the cybersecurity space in many ways in what might be the ultimate win for the cybersecurity industry against cyber criminals.

AI/ML in cybersecurity involves deploying self-sufficient tools that can detect, stop, or prevent threats without any human intervention...

This chapter has looked at the evolution of cybersecurity from legacy to advanced and then on to futuristic technologies such as AI and ML. It has been explained that the first cybersecurity system was an antivirus system that was created to stop the first worm. Cybersecurity then followed this example, where security tools were created as responses to threats. Legacy security systems started the approach of using signature-based detection. This is where security tools would be loaded with signatures of common malware and use this knowledge base to detect and stop any program that matched the signature. However, the security systems were focused on malware, and thus, hackers focused on breaching organizations through the network. In 1970, an OS company was breached via its network and a copy of an OS was stolen. In 1990, the US military suffered a similar attack where...

The following are resources that can be used to gain more knowledge of the subjects covered in this chapter:

• The Evolution of Phishing: https://www.tripwire.com/state-of-security/featured/evolution-phishing/
• Social Engineering: an IT Security problem doomed to get worse: https://medium.com/our-insights/social-engineering-an-it-security-problem-doomed-to-get-worst-c9429ccf3330
• Cost of a Data Breach Study: https://www.ibm.com/security/data-breach
• The Evolution of Cyber Threat and Defence: https://www.infosecurityeurope.com/__novadocuments/96072?v=635742858995000000

• What's Lurking Back There: Cybersecurity Risks in Legacy Systems: https://businesslawtoday.org/2018/03/whats-lurking-back-there-cybersecurity-risks-in-legacy-systems/
• Legacy cybersecurity products failed to protect 97% of organizations: https://www.helpnetsecurity.com/2014/05/21/legacy-cybersecurity...