Across 1988 to 2024, the same causes appear again and again: unsafe defaults, slow patching, shared components nobody reviews, and misplaced trust. Here are seven lessons, each tied to an incident described in other posts in this series, with dates taken from the sources listed below.
1. Defaults are decisions
The Morris worm of November 1988 spread through a sendmail debug hole, trusted logins and weak passwords. Convenience features were the entry point.
2. The fix is not the finish line
Code Red appeared about a month after its patch, and Slammer about six months after the flaw was first reported. Publishing a patch protects only those who apply it.
3. Old code can hide old bugs
Shellshock existed from 1989 to 2014. Heartbleed lasted from December 2011 to April 2014. Age does not equal review.
4. Shared components multiply risk
Log4Shell, scored CVSS 10, affected applications that logged user input with Log4j 2. One library, many victims, and several follow-on fixes.
5. Trust is relative
Thompson's compiler backdoor argument says you trust more than your own code. The build chain is part of the trusted base, and SolarWinds showed an attacker in the publishing infrastructure from September 2019 at the latest.
6. Disclosure needs a process
CERT/CC was created in 1988 after the Morris worm, and its typical window is 45 days if a vendor does not respond. Project Zero uses 90 days. Clear timelines turn argument into routine.
7. People are part of the system
XZ Utils shows a campaign aimed at a volunteer maintainer over more than two years. No scanner reads that.
Using the list
Pick one lesson that your team would currently fail. For many, it is the second: the gap between a patch being published and being deployed. Measure that gap for the last ten advisories and put the number where managers can see it.
What this list leaves out
Seven items cannot cover a field. Cloud misconfiguration, identity abuse and phishing all deserve their own histories, and this series does not claim to cover them.
How to run this as a workshop
Print the seven lessons and give a copy to each team lead. Ask them to mark which ones their team would pass today, which ones are uncertain, and which ones they would fail. Collect the marks and look for any lesson that several teams failed. That is a shared weakness, and a shared fix is cheaper than separate ones. Keep the session to forty five minutes, end with one owner and one date for each chosen fix, and review the marks again in three months.
Quick check
Which lesson comes from Code Red and Slammer?
That a published patch protects only those who apply it.
How long was the Shellshock bug present before disclosure?
About 25 years.
Safeguard offers SBOM and dependency scanning, reachability analysis and policies, and there is a free scan at gold.safeguard.sh/scan.
Sources
- Morris worm
- Code Red
- SQL Slammer
- Shellshock
- Heartbleed
- Log4Shell
- Trusting trust
- 2020 United States federal government data breach
- CERT Coordination Center
- Responsible disclosure
- XZ Utils backdoor
Last reviewed: 19 October 2026.
