The rise of viruses, worms and expanding cyber threats

The first widely recognized digital viruses appeared in the early 1980s, coinciding with the rise of personal computing. One of the more notorious examples was the Jerusalem virus, which infected systems and corrupted executables. Unlike today’s threats, these early viruses spread primarily through physical media — floppy disks — yet they already demonstrated the dual risks of propagation and payload damage.

In November 1988, the internet experienced its first widespread incident with the Morris worm. The worm exploited a buffer overflow in the sendmail program and took advantage of debug mode defaults. It slowed network performance and infected thousands of systems worldwide. Its unintended consequences highlighted how interconnected systems amplify impact.

Perhaps the most striking milestone in cyberattack sophistication is Stuxnet, discovered in 2010. Stuxnet targeted industrial control systems, specifically Iran’s nuclear centrifuges, and spread via USB drives and Windows networks. Its complexity — including multiple zero-day exploits and signed malware drivers — signaled a new era where cyberweapons could affect physical infrastructure.

Today, the threat landscape includes not only viruses and worms but ransomware, supply-chain attacks, and state-affiliated campaigns targeting enterprises and critical infrastructure. According to the IBM Cost of a Data Breach Report, the average cost of a breach hit $4.45 million in 2025, with healthcare, energy and financial services among the hardest hit sectors. 

The growing intersection of video surveillance and cybersecurity

The video surveillance industry often intersects with cybersecurity in ways that may not be immediately obvious. When Axis Communications launched the first IP camera in 1996, it ran on a custom OS designed for simplicity and limited interfaces, which in itself provided a degree of security. Hacking such a device offered little advantage and minimal reward. However, as cameras evolved, so did expectations.

With the proliferation of network-connected devices and Linux-based embedded systems, the attack surface expanded. During the early 2000s, the industry felt this shift firsthand as malware like the Nimda virus underscored the risks faced by networked embedded devices. One customer I remember was forced to migrate from embedded DVRs with no upgrade path to an open architecture built around video encoders — a transition driven not by feature demand but by security necessity.

At Axis, we chose to embrace embedded Linux early. This required innovation, especially in constrained environments where microcontrollers had limited memory and storage. We developed techniques to store files in onboard Flash memory and adopted open-source practices that would eventually become industry standards.

The Axis 2100, our first Linux-based camera, became a bestseller, shipping over 250,000 units across six years. Yet even this success came with security lessons. Potential vulnerabilities surfaced that could not always be fully mitigated due to hardware limitations. It became evident: securing embedded systems is a continuous commitment, not a one-time feature.

OEM challenges in securing software and firmware

The mid-2010s brought new industry dynamics. Traditional analog manufacturers entered the IP domain through OEM agreements, integrating low-cost cameras into their portfolios. However, relinquishing control over the embedded software often undermined their ability to update or secure those devices effectively.

A particularly instructive incident occurred around 2013 when a widely deployed OEM camera shipped with a hard-coded root password. This security flaw contributed to widespread Internet outages. These events were wake-up calls: devices without robust, maintainable firmware pose systemic risk, especially when scaled globally. The lesson for practitioners was that security has to be integrated at the source and ownership of software updates and lifecycle management cannot be outsourced without safeguards.

The four dimensions of time in cybersecurity

Today it’s clear that cybersecurity is more than technical controls or compliance checkboxes. It is a process that unfolds over time, with multiple temporal dimensions that directly influence risk exposure. Four distinct timelines help illustrate how cybersecurity risks develop and why managing them requires sustained attention throughout a device’s lifecycle.

1. Time to discovery: This is the interval between Zero Day and discovery. Proactive detection strategies including threat intelligence, anomaly detection and bug bounty programs, shrink this window, reducing potential impact.
   
   
2. Time to fix: Once identified, vulnerabilities must be patched. Developing secure firmware across dozens or hundreds of models requires meticulous engineering and quality assurance.
   
   
3. Time to upgrade: Deployment of fixes is often the longest phase. Organizations managing thousands of devices of varying ages and models face logistical challenges. Tools that automate discovery and patching are no longer optional.
   
   
4. Time in use: Devices often operate far longer than expected. During a recent visit to Asia, I saw an Axis 2100 over 25 years old still running with its green light on. This reality makes lifecycle management a critical component of cybersecurity — requiring both long-term support as well as clear strategies for patching, monitoring and ultimately decommissioning devices.

Security by design principles for connected devices

For organizations building and deploying connected systems — whether cameras, IoT devices or enterprise-scale platforms — several principles have emerged as best practices:

• Secure defaults: Devices should ship with hardened configurations, no default passwords and minimal open services. 
  
  
• Firmware integrity: Cryptographically signed firmware and secure boot mechanisms protect against tampering.
  
  
• Update mechanisms: Built-in, automated update frameworks ensure devices remain current against evolving threats.
  
  
• Auditing and monitoring: Devices need to be visible to IT Security infrastructure. Audit logs provide ways to have devices monitored by other security platforms and alert on anomalies.
  
  
• Transparency and disclosure: Clear vulnerability disclosure policies and participation in coordinated vulnerability disclosure (CVD) programs build trust and resilience.
  
  
• Continuous responsibility: Security is a continuous responsibility, requiring ongoing updates, monitoring and end-of-life management to maintain protection throughout a device’s lifecycle.

Security also intersects with compliance frameworks such as ISO/IEC 27001, the NIST Cybersecurity Framework (CSF), ETSI EN 303 645 and IEC 62443 for industrial control systems. In addition, organizations often pursue certifications and audits such as SOC 2 (Service Organization Control Type 2) to demonstrate controls over data security and FIPS 140-3 for cryptographic modules.

Adoption of these standards and certifications not only bolsters defenses but also aligns with enterprise risk, regulatory and governance expectations, while helping integrators and end customers trust the security posture of connected devices.

Moving from cybersecurity awareness to accountability

From semaphore towers to IP cameras, the history of information systems shows one constant: as long as networks convey value, adversaries will seek to exploit them. For Axis Communications, this reality is not theoretical, it informs how we design, build and support our solutions. But for the industry as a whole, the lesson is more urgent. Cybersecurity can no longer be treated as a feature, a procurement checkbox, or even a periodic upgrade cycle. It must be treated as a continuous operational discipline, embedded across the entire lifecycle of connected devices.

For security leaders and system integrators, this means shifting focus in several fundamental ways. First, security responsibility must extend beyond initial deployment to full lifecycle ownership, where devices are continuously monitored, updated and managed over years of operation. At the same time, organizations must move beyond compliance toward true resilience.

While certifications and standards provide an essential baseline, real security depends on the ability to rapidly detect threats, respond effectively and recover with minimal disruption. Finally, there must be a shift from viewing devices in isolation to understanding interconnected risk, recognizing that every camera, sensor, or edge device contributes to a broader attack surface where vulnerabilities can propagate across networks.

The “four dimensions of time” — detect, fix, upgrade and time in use — provide a practical lens for evaluating this shift. Organizations that can compress these timelines will be far better positioned to reduce risk and respond to emerging threats.

Ultimately, a “smarter, safer world” is defined not just by the intelligence of its devices, but by the trustworthiness of the people and processes behind them. Achieving that trust demands innovative thinking, sustained vigilance, shared responsibility and a long-term commitment to security at every level of the ecosystem.