Foundations of Modern Cybersecurity Offense and Defense

The asymmetric confrontation between offensive and defensive capabilities has always been the core driving force of the evolution of the cybersecurity industry, and this dynamic equilibrium is being reshaped by technological iteration and scenario expansion at an unprecedented rate. According to the 2023 Verizon Data Breach Investigations Report (DBIR), 83% of exploited vulnerabilities had publicly available Common Vulnerabilities and Exposures (CVE) records at the time of breach, yet the average time to remediate (MTTR) critical vulnerabilities remains as high as 287 days, a gap that directly reflects the inherent imbalance between offensive and defensive resource allocation. For intermediate practitioners who have mastered basic network security knowledge, understanding the evolutionary logic of modern offense-defense, the boundaries of compliant practice, and the collaborative mechanism of red-blue-purple teams is not only the cornerstone of subsequent practical capability improvement, but also the key to avoiding legal and ethical risks in practical operations.

The evolution of modern cybersecurity offense-defense can be clearly divided into three distinct stages, each corresponding to the transformation of core technical architecture and threat model. From the 1990s to the early 2000s, the traditional network defense era was dominated by perimeter-based security models, with firewalls, intrusion detection systems (IDS), and intrusion prevention systems (IPS) as the core defense components. The threat model at this stage was relatively simple, mainly consisting of worms, viruses, and large-scale DDoS attacks that exploited network layer vulnerabilities. Typical cases such as the 2003 Slammer worm, which infected more than 90% of vulnerable SQL Server hosts worldwide within 10 minutes of its release, caused widespread network paralysis, and forced the security industry to shift from simple access control to in-depth threat detection. From the mid-2000s to the early 2010s, with the popularization of Web 2.0 and e-commerce applications, the offense-defense focus shifted to the application layer. The Open Web Application Security Project (OWASP) released the Top 10 list of web application vulnerabilities, SQL injection, cross-site scripting (XSS), and broken authentication became the main attack vectors, and Web Application Firewalls (WAF), static application security testing (SAST), and dynamic application security testing (DAST) became the standard defense tools. Since the mid-2010s, with the large-scale popularization of cloud-native architecture, Internet of Things (IoT) devices, and the integration of IT and OT (Operational Technology) systems, the offense-defense scenario has entered a new stage of diversification: the traditional clear perimeter has been completely broken, and the attack surface has expanded from the network layer to the identity layer, container layer, supply chain layer, and even the AI model layer. The 2020 SolarWinds supply chain attack is a landmark event in this stage: attackers invaded the software construction environment of SolarWinds, a well-known network management software vendor, implanted malicious code in the official Orion software update package, and pushed it to more than 18,000 customers including the U.S. federal government, Microsoft, and Intel. The attack did not exploit any boundary defense vulnerabilities, but took advantage of the trust chain of the software supply chain, and the traditional defense means were completely ineffective.

The expansion of new scenarios has brought fundamental changes to the characteristics of offense-defense confrontation. In cloud-native environments, the original network boundary has been dissolved, and identity has become the de facto new security boundary. According to the 2023 IBM Cost of a Data Breach Report, 82% of data breaches involve the abuse of privileged identities or stolen credentials. The 2023 Okta identity breach is a typical case: attackers obtained the super administrator credentials of Okta, a leading identity and access management (IAM) service provider, through credential stuffing, and then used this privilege to access the management backend of more than 1,300 enterprise customers, including Sony, Amazon, and U.S. federal government agencies, resulting in the leakage of a large amount of user identity data. The core of cloud-native offense-defense has shifted from network access control to identity lifecycle management, including multi-factor authentication (MFA), privileged access management (PAM), and zero-trust architecture implementation.

The IoT scenario presents more complex offense-defense challenges due to its characteristics of large scale, weak security baseline, strong heterogeneity, and difficulty in patching. The 2016 Mirai botnet attack is a classic example: attackers scanned IoT devices such as cameras, routers, and DVRs with open 23 ports on the Internet, used default credentials to log in, and implanted malicious code, eventually controlling more than 600,000 devices. Then they launched a massive DDoS attack on Dyn, a DNS service provider, causing paralysis of well-known websites such as Twitter, Netflix, and Spotify, and affecting nearly half of the Internet services in the United States. The difficulty of IoT offense-defense lies in the fact that it is impossible to deploy traditional security protection means such as firewalls and antivirus software for each device individually, and most IoT devices do not have over-the-air (OTA) update capabilities, so vulnerabilities can exist for a long time. Defenders can only rely on asset discovery, traffic baseline analysis, and abnormal behavior detection to carry out protection.

The OT/industrial control system scenario has a unique offense-defense logic due to its core requirement of production availability priority. Traditional OT systems are physically isolated from IT systems, but with the popularization of industrial 4.0 and smart manufacturing, IT/OT integration has become the general trend, and the attack surface of OT systems has expanded rapidly. The 2010 Stuxnet attack is the first publicly known destructive attack targeting OT systems: attackers used 4 undisclosed 0day vulnerabilities (2 Windows system vulnerabilities, 1 WinCC SCADA system vulnerability, and 1 Siemens PLC vulnerability) to infect more than 1,000 programmable logic controllers (PLC) used in the Natanz uranium enrichment facility in Iran, and modified the speed parameter of the gas centrifuge, making the centrifuge operate at a speed far exceeding the design limit, resulting in physical damage to the centrifuge. What is particularly tricky is that the SCADA monitoring system seen by operators shows normal speed data, and it is completely impossible to detect the attack. This case highlights the core contradiction of OT offense-defense: traditional security measures such as patching, system restart, and antivirus software deployment may cause production downtime, so OT defense pays more attention to whitelisting, deep traffic detection, behavior baseline analysis, and minimum privilege principles, and cannot affect normal production processes.

For practitioners engaged in penetration testing, vulnerability mining, and other offensive and defensive practices, compliance with ethical principles and legal boundaries is the bottom line that cannot be crossed. Over the past decade, global regulatory authorities have successively introduced a series of regulatory frameworks to standardize the behavior of the cybersecurity industry. The EU's revised Network and Information Security Directive (NIS2) covers 14 critical fields including energy, transportation, medical care, and finance, requiring critical information infrastructure (CII) operators to conduct penetration testing at least once a year, establish a vulnerability disclosure mechanism (VDP), and report major security incidents to regulatory authoritie