1 NT U1 History of IS

NETWORK TECHNOLOGIES
HISTORY OF INFORMATION SECURITY

Information -Definition
Information is defined as:

Knowledge obtained from investigation, study, or
instruction, intelligence, news, facts, data, a
signal or character (as in a communication
system or computer) representing data,
something (as a message, experimental data, or
a picture) which justifies change in a construct
(as a plan or theory) that represents physical or
mental experience or another construct
Security -Definition
Security is defined as:
Freedom from danger, safety; freedom from fear

or anxiety
Information Security -Definition
Measures adopted to prevent the unauthorized

use, misuse, modification, or denial of use of
knowledge, facts, data, or capabilities
Brief History of Security
The security of information and other assets has

evolved over time as society and technology have
evolved.
Evolution is important to understanding how it is
needed to approach security today.
The following sections follow security in a rough

chronological order.
Physical Security
In history, all assets were physical. Important

information was also physical, as it was carved
into stone and later written on paper.
To protect these assets, physical security was
used, such as walls, moats, and guards.
 If the information was transmitted, it usually
went by messenger and usually with a guard.
Communication Security
Physical security had a flaw. If a message was

captured in transit, the information in the
message could be learned by an enemy.
 As far back as Julius Caesar, this flaw was
identified. The solution was communications
security. Julius Caesar created the Caesar cipher.
 This cipher allowed him to send messages that
could not be read if they were intercepted.
Communication Security- Enigma
Germany used a
machine called Enigma
to encrypt messages
sent to military units.
The Germans
considered Enigma to
be unbreakable, and if
it had been used
properly it certainly
would have been very
difficult to break.
AF
Japan used code words for their objectives during

the war and that made true understanding of
their messages difficult
One-time pads
The Soviet Union used one-time pads to protect

information transmitted by spies.
The one-time pads were literally pads of paper
with random numbers on each page. Each page
was used for one message and only one
message.
Emissions Security
In the 1950s it was learned that access to

messages could be achieved by looking at the
electronic signals coming over phone lines.
All electronic systems give off electronic
emissions. This includes the teletypes and the
encryptor being used to send encrypted
messages.
Emissions Security
The encryptor would take in the message,

encrypt it, and send it out over a telephone line.
 It was found that electric signals representing
the original message were also found on the
telephone line. This meant that the messages
could be recovered with good equipment.
The United States created a program called
TEMPEST. It created electrical emissions
standards for computer systems used in very
sensitive environments.
Computer Security
Computers came on the scene and most of the

information assets of organizations migrated on
to them in an electronic format.
The information on the systems became

accessible to anyone who had access to the
system. This gave rise to the need for computer
security.
Computer Security
In the early 1970s, David Bell and Leonard La

Padula developed a model for secure computer
operations.
This model was based on the government concept

of various levels of classified information
(unclassified, confidential, secret, and top secret)
and various levels of clearances.
Computer Security
 If a person (a subject) had a clearance level that

dominated (was higher than) the classification
level of a file (an object), that person could
access the file.
 If the person’s clearance level was lower than
the file’s classification, access would be denied.
This concept of modeling eventually lead to U.S.
Department of Defense Standard 5200.28, the
Trusted Computing System Evaluation Criteria
(TCSEC, also known as the Orange Book), in
1983.
Orange Book
The Orange Book defines computer systems
according to the following scale:
D Minimal protection or unrated
C1 Discretionary security protection
C2 Controlled access protection
B1 Labeled security protection
B2 Structured protection
B3 Security domains
A1 Verified design
Network Security
One other problem related to the computer

security evaluation criteria was the lack of a
network understanding.
 When computers are networked together, new
security problems occur and old problems behave
in different ways.
 For example, we have communications, but we
have it over local area networks instead of wide
area networks.
Red Book
The Orange Book did not address the issue of

networked computers. In fact, network access
could invalidate an Orange Book certification.
The answer to this was the Trusted Network
Interpretation of the TCSEC (TNI, or the Red
Book) in 1987.
 The Red Book took all of the requirements of the
Orange Book and attempted to address a
networked environment of computers, thus
creating the concept of network security.
Information Security
 A good security actually is a mix of all of these

solutions
Good physical security is necessary to protect
physical assets like paper records and systems.
 Communication security (COMSEC) is necessary
to protect information in transit.
Emission security (EMSEC) is needed when the
enemy has significant resources to read the
electronic emissions from our computer
systems.
Information Security

Computer security (COMPUSEC) is necessary to
control access on our computer systems, and
network security (NETSEC) is needed to control
the security of our local area networks.
 Together, these concepts provide information
security (INFOSEC).

1 NT U1 History of IS

Uploaded by

Copyright:

Available Formats

1 NT U1 History of IS

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

1 NT U1 History of IS

Uploaded by

Copyright:

Available Formats

NETWORK TECHNOLOGIES

HISTORY OF INFORMATION SECURITY

Information is defined as:

Security is defined as:

Freedom from danger, safety; freedom from fear

Measures adopted to prevent the unauthorized

The security of information and other assets has

The following sections follow security in a rough

In history, all assets were physical. Important

Physical security had a flaw. If a message was

Japan used code words for their objectives during

The Soviet Union used one-time pads to protect

In the 1950s it was learned that access to

The encryptor would take in the message,

Computers came on the scene and most of the

The information on the systems became

In the early 1970s, David Bell and Leonard La

This model was based on the government concept

 If a person (a subject) had a clearance level that

One other problem related to the computer

The Orange Book did not address the issue of

 A good security actually is a mix of all of these

You might also like