Security Professionals

With Martin Hellman, published “New Directions in Cryptography” in 1976 and showed that two parties who had never met could agree on a secret over a wire anyone could read. It broke a problem the field had considered permanent, and every TLS handshake since is a descendant. Shared the 2015 Turing Award for it, and spent decades afterwards arguing the civil-liberties side of the crypto policy fights.

Co-author of the 1976 paper and Stanford professor who then refused to let the NSA classify academic cryptography out of existence, publishing and teaching through explicit pressure to stop. Also co-authored the early analysis of DES key length that argued, correctly and years early, that 56 bits was not enough. Shared the 2015 Turing Award with Diffie.

Co-invented the RSA cryptosystem at MIT in 1977 with Shamir and Adleman, turning public-key cryptography from a proposal into something you could ship. Went on to design MD2, MD4, MD5, RC4, RC5 and RC6, co-author the standard algorithms textbook, and spend his later career on verifiable election systems. Turing Award, 2002.

Co-invented RSA, then invented Shamir secret sharing, then co-developed differential cryptanalysis with Eli Biham — the technique that turned out to be the one the DES designers had quietly hardened against seventeen years earlier. Also a co-author of the cube attack and a long line of side-channel work. Turing Award, 2002.

The third name on the RSA paper, whose role was to keep breaking the schemes Rivest and Shamir proposed until one survived. Later coined the term “computer virus” for Fred Cohen’s 1983 experiments, and founded DNA computing with a molecular solution to the Hamiltonian path problem. Turing Award, 2002.

Released Pretty Good Privacy as free software in 1991, and it escaped onto the internet worldwide. The US government opened a three-year criminal investigation into him for munitions export, dropped it in 1996 without charges, and the crypto-export regime never recovered. He later co-founded Silent Circle and worked on ZRTP for encrypted voice.

Wrote Applied Cryptography in 1994, the book that taught a generation of engineers how ciphers actually work, then designed Blowfish and co-designed Twofish. Spent the two decades after arguing the harder point: that security is a systems and incentives problem, not a maths problem. Coined “security theatre”, has written the Crypto-Gram newsletter since 1998, and helped report on the Snowden documents.

Published the timing-attack paper in 1996 and differential power analysis in 1999, establishing that a correct implementation of a correct algorithm can still leak its key through how long it takes or how much current it draws. Co-authored the SSL 3.0 specification, founded Cryptography Research, and in 2018 was one of the co-discoverers of Spectre.

Published “An Intrusion-Detection Model” in 1987, the paper that framed detection as statistical deviation from a profile of normal behaviour and gave the entire monitoring industry its foundation. Also wrote Cryptography and Data Security, worked on database security and lattice-based information flow, and was one of the few academics engaging seriously with both sides of the Clipper chip debate.

Produced one of the first detailed technical analyses of the 1988 Morris worm while the internet was still smoking, co-wrote Practical UNIX and Internet Security with Simson Garfinkel, co-created Tripwire, and founded Purdue’s COAST lab and then CERIAS — for years the largest academic security centre in the US. Has advised more federal panels than most people have attended.

Cambridge professor who wrote Security Engineering, the closest thing the field has to a canonical text, and gave away earlier editions free online. Founded the security-economics research programme with the observation that systems fail because the people who could fix them are not the people who bear the loss. Spent years demonstrating that bank chip-and-PIN systems were weaker than the banks told courts they were. Died in 2024.

Found the protocol flaw in the NSA’s Clipper chip escrow scheme in 1994 and published it, which did more to end mandated key escrow than any amount of lobbying. Later led state-commissioned source reviews of US voting systems, published work on the vulnerabilities of master-keyed physical locks and wiretap systems, and became a law-school professor arguing the same points to a different audience.

Invented the spanning-tree protocol that made large bridged Ethernets possible, and did the early work on routing protocols designed to keep functioning when a participating node is actively hostile rather than merely broken. Co-wrote Network Security: Private Communication in a Public World, and designed the “ephemerizer” approach to making data reliably expire.

Wrote the 1989 paper cataloguing the security problems in TCP/IP — sequence-number prediction, source routing, DNS spoofing — years before anyone was exploiting them at scale. Co-authored Firewalls and Internet Security with Cheswick, co-invented encrypted key exchange, was a Usenet co-creator, and served as chief technologist at the FTC and on the Privacy and Civil Liberties Oversight Board.

Co-wrote the 1994 book that taught the industry what a firewall was and how to reason about a perimeter. “An Evening with Berferd” documented him feeding a live intruder a fake environment for months and writing down everything, which is the honeypot genre’s founding text. Later ran the Internet Mapping Project at Bell Labs.

Built DEC SEAL, generally credited as the first commercial firewall product, then the TIS Firewall Toolkit and Gauntlet — the code most early internet perimeters were actually made of. Ran whitehouse.gov’s first email server. Has spent the decades since publicly arguing that most of what the industry sells does not work, which has aged better than the products did.

Wrote TCP Wrapper, which for years was the access control on a very large share of Unix hosts on the internet, and Postfix, a mail server written from the start around privilege separation. Co-wrote SATAN with Dan Farmer and later the Coroner’s Toolkit and Forensic Discovery, giving incident responders their first real open tooling.

Wrote COPS as a student, then in 1995 released SATAN with Wietse Venema — a scanner that audited a network the way an attacker would, published openly so defenders could run it first. The press predicted the end of the internet; SGI fired him over it; the security scanner became a permanent product category. Later co-wrote Forensic Discovery.

Released Nmap in Phrack in 1997 and has maintained it ever since, adding OS fingerprinting, service detection and the NSE scripting engine. Runs seclists.org, hosting the Bugtraq and Full Disclosure archives that are the field’s institutional memory, and fought MPAA and studio takedown attempts over the tool. Nmap is the first command most defenders learn.

Wrote Snort in 1998 as a lightweight packet sniffer, and it became the intrusion detection system that put IDS within reach of organisations that could never have bought one. Founded Sourcefire around it, which Cisco acquired in 2013. The Snort rule syntax outlived the product and is still how a large part of the industry writes network detections.

Started Ethereal in 1998 because commercial protocol analysers cost more than his employer would spend, renamed it Wireshark in 2006 after a trademark problem, and has shepherded it ever since through thousands of contributed protocol dissectors. It is the default answer to “what is actually on the wire” for network engineers and incident responders alike.

Released Nessus in 1998 as a free scanner with its own plugin language, at a point when the alternative was an expensive appliance. Co-founded Tenable Network Security around it in 2002 and took the product closed-source in 2005, a decision the community argued about for years. Vulnerability management as a routine operational practice largely grew out of that codebase.

Maintained BIND for years and wrote or co-wrote a long run of DNS RFCs, then built the response-policy zone mechanism that lets defenders block malicious domains at the resolver. Founded the first anti-spam DNSBL, ran the Internet Software Consortium, operates F-root, and co-founded Farsight Security around passive DNS. Internet Hall of Fame, 2014.

Wrote honeyd, co-designed the bcrypt password hash with David Mazières, and created systrace and privilege separation work in OpenSSH. At Google he led the Safe Browsing malware research that put interstitial warnings in front of drive-by download sites, and co-authored the papers that measured how large that problem actually was.

Was an information security officer at Yahoo before founding WhiteHat Security in 2001, where continuous scanning of thousands of production sites produced the first credible public statistics on how long real web vulnerabilities actually stay open. Co-founded the Web Application Security Consortium, and co-authored XSS Attacks: Cross Site Scripting Exploits and Defense in 2007 — the book that turned cross-site scripting from a curiosity into a class of bug developers were expected to know.

Ran ha.ckers.org and published the XSS cheat sheet, which for years was the reference list of filter-evasion payloads that every web application firewall was tested against. Co-authored XSS Attacks with Grossman, released Slowloris to demonstrate that a single machine could hold a web server’s connections open indefinitely, and co-wrote Detecting Malice on behavioural detection.

Started the Open Web Application Security Project in September 2001 as a mailing list and a few documents, and it became the vendor-neutral body that produced the Top Ten, the ASVS, ZAP and the testing guides that appsec teams still work from. Later founded SourceClear on software composition analysis and has kept publicly pushing OWASP to stay relevant to modern supply-chain risk.

Wrote the first OWASP Top Ten and served as the volunteer chair of OWASP from 2003 to 2011, the years in which it went from a mailing list to the reference that PCI DSS and a long line of other standards cite by name. Co-founded Aspect Security and then Contrast Security, arguing for instrumentation inside the running application rather than scanning it from outside.

Wrote Building Secure Software, Exploiting Software and Software Security, making the case that you cannot test defects out of a system you designed insecurely. Co-created BSIMM, which measures what security programmes actually do rather than what a standard says they should, and has run a long-standing interview series documenting the field’s own history.

Co-wrote Writing Secure Code, which Bill Gates ordered Windows engineers to read during the 2002 Trustworthy Computing halt, and helped build the Security Development Lifecycle that came out of it — threat modelling, banned APIs, fuzzing and a final security review before ship. The SDL became the template most large software organisations copied.

Drove threat modelling into shippable practice at Microsoft, including the Elevation of Privilege card game that got non-security engineers doing it voluntarily, then wrote Threat Modeling: Designing for Security and later Threats: What Every Engineer Should Learn. Served on the CVE editorial board and co-wrote The New School of Information Security on learning from breach data.

Wrote ModSecurity, the open-source web application firewall that became the reference implementation and the base of the OWASP Core Rule Set. Then built SSL Labs, whose A-to-F grade for a server’s TLS configuration turned an obscure ops detail into something executives asked about, and wrote Bulletproof TLS and PKI as the manual for fixing the grade.

Co-wrote The Art of Software Security Assessment with John McDonald and Justin Schuh, still the most thorough published treatment of how to find memory-safety and logic flaws by reading code. Found deep bugs in Sendmail, OpenSSH and Flash while at ISS X-Force and IBM, and founded Azimuth Security. His work is why a generation of auditors know what to look for in a parser.

Built the graph-based binary diffing that made it routine to extract the vulnerability out of a vendor patch, founded zynamics around BinDiff and VxClass, and sold it to Google in 2011. Later worked in Project Zero and wrote the “weird machines” framing that treats exploitation as programming an unintended state machine inside the target.

Co-authored “Bypassing Browser Memory Protections”, the 2008 paper that showed how attackers were routing around DEP and ASLR, then at 25C3 the same year demonstrated a working rogue certificate authority built on MD5 collisions — which pushed the CA industry off MD5 for good. Co-founded Trail of Bits.

Co-wrote the 1998 paper with Timothy Newsham showing that a network IDS which reassembles traffic differently from the host it protects can be walked straight past — the work that forced every vendor to rethink normalisation. Co-founded Matasano and later Latacora, and wrote the Cryptopals challenges that taught a generation how crypto actually breaks.

Johns Hopkins cryptographer who co-led the Open Crypto Audit Project’s review of TrueCrypt, contributed to the analysis of Dual_EC_DRBG and the RSA BSAFE backdoor, and worked on the attacks behind Logjam and DROWN. His blog is the standard place the rest of the industry goes to find out how badly a new crypto story is being reported.

Co-authored the cold boot attack paper showing DRAM retains keys after power off, then spent a career demonstrating — in court and in front of legislatures — that deployed voting machines could be reprogrammed. Co-founded the Internet Security Research Group behind Let’s Encrypt, and co-authored the ZMap internet-wide scanner and the Logjam and FREAK results.

Co-authored “Mining Your Ps and Qs”, which scanned the whole IPv4 internet and found that a meaningful share of TLS and SSH keys shared factors because embedded devices generated them without entropy — and then factored them. Followed it with Logjam, DROWN and FREAK, a body of work whose method is: measure what is actually deployed, then break the weak part.

Built Have I Been Pwned in 2013 as a way for ordinary people to find out whether their account was in a dump, and it became infrastructure: browsers, password managers and the NIST-endorsed practice of checking passwords against known-breached lists all query it, using a k-anonymity scheme that never sends the password. Runs it as a public good rather than a product.

Was security lead and signoff for Windows XP Service Pack 2 and Windows Server 2003, co-wrote the Threat Modeling book that came out of that era, then ran security at Mozilla for Firefox, at Apple on privacy and security strategy, at Fastly and Square, and became Intel’s first chief software security officer. Founded Thistle Technologies in 2020 to bring update infrastructure to embedded devices.

A founding member of Google’s security team who built and ran its incident response function, including the response to the 2009 Operation Aurora intrusion that Google chose to disclose publicly — a decision that reset industry norms on breach transparency. Co-authored Building Secure and Reliable Systems, and has served on US federal cybersecurity advisory bodies.

Joined Google as a penetration tester, printed “Security Princess” on her business card, and rose to run Chrome. Led the multi-year project to mark plain HTTP as “Not secure” in the world’s most-used browser, which more than anything else moved the web to encryption by default, and pushed Project Zero’s 90-day disclosure deadline as an industry-wide forcing function.

Was CISO at Yahoo, where he objected to a government email-scanning programme, then CSO at Facebook through the investigation into foreign influence operations, leaving in 2018 over how much the company would disclose. Publicly challenged the NSA director on encryption backdoors, founded the Stanford Internet Observatory, and co-founded iSEC Partners and later Krebs Stamos Group.

Co-authored the 2003 CCIA report arguing that monoculture in operating systems was itself a national security risk, and was fired by @stake, then a Microsoft consultancy, the day it was published. Went on to serve as chief information security officer of In-Q-Tel and to give a run of Black Hat and USENIX keynotes that are still the most quoted long-form arguments about security policy the field has produced.

Founded Mandiant in 2004 and built breach response into a business that governments and Fortune 100 boards call at 2am. In 2013 the company published APT1, a report attributing years of intrusions to a specific People’s Liberation Army unit with building photographs and operator handles — the moment public, named attribution became something private companies did.

Has been analysing malware at F-Secure since 1991, through the DOS virus era, Sasser and Blaster, Stuxnet and modern ransomware. Tracked down and interviewed the Pakistani brothers who wrote Brain, the first PC virus, twenty years after the fact. Formulated Hyppönen’s law — if it is smart, it is vulnerable — and is the researcher most often trusted to explain a live incident to the public.

A former US Air Force cyber warfare officer who co-authored the analysis of the 2015 Ukrainian power grid attack and the later CRASHOVERRIDE and TRISIS malware, then founded Dragos to do industrial control system defence as a specialism rather than an IT afterthought. Co-wrote the SANS ICS courses that most OT defenders come through.

Led incident response at Motorola Solutions and then at Dragos, running investigations inside live industrial networks where you cannot simply reimage the plant. Writes long-running public guidance on breaking into and surviving the profession, founded PancakesCon, and holds the SANS Lifetime Achievement Award for that work as much as the casework.

Was the threat intelligence lead for MITRE ATT&CK during the years it became the shared vocabulary defenders use to describe adversary behaviour, then went to Red Canary as director of intelligence. Teaches the SANS cyber threat intelligence course and spends most of her public work on the unglamorous question of how an intelligence report turns into a detection someone actually deploys.