Title: The History of Information Security
Course: IN 2001 Principle of Information Assurance > Section: Module 1: Chapter One

The History of Information Security

The need for computer security or the need to secure the physical location of hardware from outside threats, began almost immediately after the first mainframes were developed.

Groups developing code-breaking computations during World War II created the first modern computers.

Badges, keys, and facial recognition of authorized personnel controlled access to sensitive military locations.

In contrast, information security during these early years was rudimentary and mainly composed of simple document classification schemes.

There were no application classification projects for computers or operating systems at this time, because the primary threats to security were physical theft of equipment, espionage against the products of the systems, and sabotage.

The 1960s

During the 1960s, the Department of Defense’s Advanced Research Procurement Agency (ARPA) began examining the feasibility of a redundant networked communications system designed to support the military’s need to exchange information.

Larry Roberts, known as the founder of the Internet, developed the project from its inception.

The 1970s and 80s

During the next decade, the ARPANET grew in popularity and use, and so did its potential for misuse.

In December of 1973, Robert M. Metcalfe indicated that there were fundamental problems with ARPANET security.

Individual remote users’ sites did not have sufficient controls and safeguards to protect data against unauthorized remote users.

There were no safety procedures for dial-up connections to the ARPANET.

User identification and authorization to the system were nonexistent.

Phone numbers were widely distributed and openly publicized on the walls of restrooms and phone booths, giving hackers easy access to ARPANET.

The movement toward security that went beyond protecting physical locations began with the Rand Report R-609, sponsored by the Department of Defense, which attempted to define multiple controls and mechanisms necessary for the protection of a multilevel computer system.

The scope of computer security grew from physical security to include:

- Safety of the data itself
- Limiting of random and unauthorized access to that data
- Involvement of personnel from multiple levels of the organization

At this stage, the concept of computer security evolved into the more sophisticated system we call information security.

MULTICS

Much of the focus for research on computer security centered on a system called MULTICS (Multiplexed Information and Computing Service).

In mid-1969, not long after the restructuring of the MULTICS project, several of the key players created a new operating system called UNIX.

While the MULTICS system had planned security with multiple security levels and passwords, the UNIX system did not.

In the late 1970s, the microprocessor brought in a new age of computing capabilities and security threats as these microprocessors were networked.

The 1990s

At the close of the 20th century, as networks of computers became more common, so too did the need to connect the networks to each other.  This gave rise to the Internet, the first manifestation of a global network of networks.

There has been a price for the phenomenal growth of the Internet, however.  When security was considered at all, early Internet deployment treated it as a low priority.

As the requirement for networked computers became the dominant style of computing, the ability to physically secure the physical computer was lost and the stored information became more exposed to security threats.

The Present

Today, the Internet has brought millions of unsecured computer networks into communication with each other.

Our ability to secure each computer’s stored information is now influenced by the security on each computer to which it is connected.