USC Upstate cybersecurity lab director Melissa Davis instructs students during summer cyber camp. Photo courtesy of USC Upstate.
Editor’s Note: This is the second in a three-part series.
On Nov. 3, 1988, long before most of the world would hear of dot-com and cyberspace, Eugene Spafford, an assistant professor of computer science at Purdue University, awoke to a peculiar problem: he could not log into his school computer from home.
At first, he thought his machine just needed rebooting.
“But later I started looking at system logs on that machine, and some others,” said Spafford, now a distinguished professor of computer science entering his 40th year at Purdue. “And I found evidence that [a computer worm] had been present.”
The worm turned out to be the first stand-alone computer malware — created by Robert Tappan Morris, a Cornell University graduate student, who would soon become the first person indicted under the U.S. Computer Fraud and Abuse Act.
At the time, the number of potentially vulnerable machines hovered under 80,000 worldwide — and there was barely any such thing as cybersecurity.
But in the 38 years since Morris’s worm, the world of computers and information technology has evolved into a multi-billion-dollar industry with 6 billion-and-counting global Internet users.
And behind the scenes, countless information technology professionals are fighting invisible cyber criminals in a war that is becoming more intense, more expensive, and more challenging to keep personal information and business operations safe.
“For many attackers, it is easier now to compromise an IT system than it was 10 years ago,” Spafford said. “There are more systems, and they are more complex and feature-rich, so the attack surface has grown – and with it, the room for flaws and misconfigurations.”
One summer casualty in this cyber war was the Spartanburg County government offices, whose information technology systems were down for 17 days in June.
And since County systems were previously broken into twice before – in April 2023, and again in August 2025 – future security is likely to look a lot different.
“The best-maintained systems are harder to attack than before because well-prepared sites have invested in maturing their protections,” Spafford said. “The result is a widening gap between the well-defended and everyone else.”
He pointed out that this gap is one reason criminal and state actors (state-sponsored cyber attacks) increasingly target third-party firms to work their way into the supply chain.
“Indirect attacks against trusted suppliers are harder to defend against, and they route around hardened targets,” said Spafford, noting that the rise of Artificial Intelligence now plays a key role in cyber attacks. “AI lets attackers quickly try many known attack paths against many targets, and it can surface flaws faster. An attacker who finds one before the defender gains the advantage.”
GROWING ARRAY OF TARGETS
That advantage keeps increasing as the number of computer devices keeps rising.
For example, when Spafford experienced the first malware worm in 1988, personal computers were comparatively few in number: approximately 14 million or 15 % of U.S. households.
https://www2.census.gov/library/publications/1991/demographics/p23-171.pdf
No smart phones. No global Internet. And no laptops or gaming devices that anyone from the last two generations would recognize.
But by 2001, officials with the U.S. Dept. of Commerce found that the number of personal computers had increased more than four-fold to 60.2 million – more than half of all U.S. homes – with nearly 9 out of 10 having Internet access as well.
https://www.discovery.org/m/securepdfs/2021/08/Bandwidth-2002-03-27_490k.pdf
“The average number of personal computers used to be one per family,” said Dr. Noah Schiffman, co-owner of Secursion.ai, which helps companies strengthen their cyber defenses. “Now the average is approaching 7-8 per person, and includes desktops, laptops, smart TVs, gaming systems, wearables, speakers, smartphones, tablets, security cameras, and other smart-home equipment.”
He added that when a new product comes out regarding defense technology, protocol, or transmission method, attackers often try to get around it through reverse engineering.
“Once many of the AI products become more solidified and embedded into the corporate structure/workflow, we’ll see a surge in hacking tools/methods,” he said. “Once you understand how something works, you start to wonder: what else can I make this item do?”
GROWING NUMBER OF RISKS
When asked the No. 1 priority for U.S. companies and organizations to earmark in order to stand the lowest risk of having their IT systems hacked or compromised, Schiffman pointed to Identity Security.
“This has become the single biggest battlefield in cybersecurity,” he said. “Ten years ago, attackers primarily broke into networks by exploiting software vulnerabilities. Today, they increasingly log in instead of breaking in.”
And while organizations spend millions on firewalls, Endpoint Detection and Response, and AI-powered detection, Schiffman said attackers frequently steal credentials and by-pass phishing-resistant methods through:
• AI-generated phishing.
• Deepfake voice calls.
• Multi-Factor Authentication fatigue attacks.
• Infostealer malware.
• Browser session theft.
• Application Programming Interface token theft.
• Cookie hijacking.
“Once an attacker owns an identity, many security products assume they're a legitimate user,” Schiffman said. “Nearly every major ransomware campaign, cloud compromise, and data breach now involves compromised identities somewhere in the attack chain.”
GROWING NUMBER OF COMBATANTS
In its 2025 Internet Crime Report, FBI officials reported a national average of 3,000 complaints per day – more than 1 million per year, and 3.5 times the amount from 2015.
The rise in these attacks has created more and more demand for cyber professionals.
Many schools and institutions in the U.S. that only a short time ago never even offered basic cyber classes now offer degrees and certificates with training and courses in computer engineering and security principles.
In South Carolina, these schools include The Citadel, USC in Columbia, Trident Technical College in Charleston, Winthrop University in Rock Hill, Spartanburg Community College under the tutelage of Dr. Kenneth Gardner – and USC Upstate in Spartanburg, which has seen its number of cyber majors go from only a handful when the program launched in 2020 to more than 90 now.
“The program has grown rapidly,” said Melissa Davis, chair of computer science director of USC Spartanburg’s cyber security lab. “Our students majoring in computer science and computer information systems are receiving an increasing amount of cybersecurity training as we integrate it more broadly across our computing programs.”
Spartanburg Community College has seen an even greater rise in both cyber majors and offerings.
For example, SCC’s initial offering in 2019 for was introduced as an option within the associate degree program. About 149 students showed up for the inaugural classes, and the next year this number started dropping.
By Fall 2025, however, it had jumped to 224 students with declared cybersecurity majors – and far from just being an elective, the program now prepares students for many career options through firsthand experience with networking, operating systems, information security, network vulnerability assessment, digital forensics, and cybersecurity operations.
And also in 2025, SCC was designated by the National Security Agency in Washington, D.C., as a National Center of Academic Excellence in Cyber Defense.
“The curriculum also incorporates Cisco Networking Academy materials and prepares students for industry certifications, including Cisco CCNA and CyberOps,” said SCC public information officer Tameka Whittenburg. “Like other higher education institutions, SCC must remain vigilant against evolving cybersecurity threats, including phishing and other attempts to gain unauthorized access to systems or information.”
The lingering question now is: Will all the training, all the heightened security measures, and all the mounting cyber professionals be enough to beat the attackers?
“I expect, as always, for the hackers to stay a couple steps ahead of the security personal,” Schiffman said. “But a change in power dynamic would be nice for a change.”
Next Week: Solutions, Changes, and the role of AI
