🔐The Greats

At Stanford, Hellman and Diffie pursued a way for two people with no prior shared secret to agree on one over a public channel. Their 1976 publication opened an argument with government agencies over who should control strong cryptography.

In 1987, Denning published an intrusion-detection model that described using audit data to identify abnormal behavior. The work gave later security operations teams a conceptual basis for detecting misuse rather than only controlling access.

Kaminsky discovered that attackers could exploit predictable DNS transaction identifiers to redirect users to malicious sites. Rather than announce it immediately, he coordinated vendors, registries and operators on a patching effort, then explained the issue publicly at Black Hat 2008.

While at Microsoft, Moussouris worked on programs that paid researchers for defensive findings rather than leaving them to sell discoveries elsewhere. Her work helped establish bug bounties as a structured channel for vulnerability disclosure.

Signal's developers published protocol documentation and accepted outside cryptographic review while building a messaging service intended to make strong encryption ordinary rather than specialized. The project influenced how mainstream apps discuss private communication.

In 2006, Rutkowska demonstrated the Blue Pill proof-of-concept rootkit, using virtualization to hide malware beneath an operating system. The demonstration challenged assumptions about what conventional security software could see.

In the mid-1980s, Stoll followed a 75-cent accounting anomaly through logs and network connections. The resulting investigation revealed an intruder using university and military systems, becoming a classic account of patient evidence-led incident response.