In June 2010, a computer worm called Stuxnet was discovered. Soon it was revealed that Stuxnet was specifically designed to attack nuclear facilities in Iran. It is claimed that this cyber attack caused mass damage in nuclear facilities of Iran namely Natanz facility. This so called cyber attack arise the question of weather Iran could use it’s right of self-defence or not? And if it can, how far it can goes. Does this attack give Iran right to bomb attackers if identified or it should limit itself to counter cyber attacks (Hack back)? This latter question is in issue in this paper.Self-defense in cyber attacks: Customary International Law (CLI) established that every states has right to undertake Self-defense measures when an adversary commits an “armed attack”. Not every cyber attack constitute an armed attack but those who enjoy “sufficient scope, duration, and intensity” can constitute it and if so there is no doubt that under CLI the state who was victim of these kind of attacks can practice it’s right to defend itself. Jus in bello rules over these measure and so they are limited to necessity and proportionality. The principle of necessity requires that any measure taken avowedly in Self-defense must have been necessary for that purpose. One of main requirement in the principle of necessity is actions taken in Self-defense must generally be taken without undue delay. In cyber attacks this requirement is not at issue as in most cases identifying cause of attack may take time. As a result nature of cyber attacks require that immediate action requirement should not strictly applied. Instead state should given enough time to practice its right of Self-defense.