Security begins with sharing
Early computers were rare and guarded in the physical sense: a locked room, a few operators. Security became a software problem only when many people began to use one machine at once. In the 1960s, time-sharing systems let users sit at separate terminals and run jobs at the same time on a single central computer. The system now had to keep one user’s files away from another’s.
The answer was the password. The Compatible Time-Sharing System at MIT is often cited as an early user of passwords for this purpose. A frequently told story says that a user soon found a way to see the file of passwords, which is the sort of lesson that repeated for decades: a protection that works in principle is only as good as how it is stored and handled. Later Unix systems stored scrambled versions of passwords rather than the passwords themselves, and added random “salt” values so that identical passwords would not look identical. That design idea is still the basis of how login systems work, although the methods have been refined many times.
Writing down the principles
By the early 1970s, the US government was a large buyer of shared computers and began to worry about sensitive and ordinary data on the same system. A 1972 planning study led by James Anderson, written for the US Air Force, laid out the problem of secure shared computing and is often treated as a starting point for the field. Researchers then produced formal models of who should be allowed to read or write what. A 1975 paper by Jerome Saltzer and Michael Schroeder set out design principles, such as giving programs only the access they need and keeping designs simple, that are still taught.
In 1983 the US Defense Department published evaluation criteria, widely nicknamed the “Orange Book” after its cover, that graded systems by the protections they offered. It was aimed at military buyers, but it gave the industry a shared vocabulary.
Encryption leaves the military
Encryption had long been the business of governments. That changed in the 1970s. The US adopted a Data Encryption Standard in 1977 for non-classified government data, so the public could study a widely used cipher. Around the same time, Whitfield Diffie and Martin Hellman published the idea of public-key cryptography in 1976, and the RSA method followed in 1977. Public-key systems let two parties establish secure communication without first meeting to swap a secret. British government researchers are reported to have found similar ideas earlier, but kept them secret.
These tools mattered because networks were arriving. Data traveling over shared lines could be read by others, so encryption moved from a niche to a requirement as commerce went online. By the mid-1990s web browsers included secure connections, which made it possible to send a payment card number across the internet with reasonable safety. Banks had meanwhile built their own protections for automated teller machines, including secret codes and encrypted links, long before the web.
Hackers, law and the first alarms
In the early 1980s the word “hacker” described both curious programmers and people breaking in. A 1983 film about a teenager who nearly starts a war by dialing into a military computer is often credited with making lawmakers pay attention, and a group of teenagers from Milwaukee, known as the 414s, were in the news the same year for breaking into various systems. In the United States, a computer fraud law passed in 1984 and was expanded in 1986.
A different sort of story came from Clifford Stoll, an astronomer who in 1986 traced a small accounting discrepancy at a laboratory to an intruder, later linked to a group selling information to the Soviet KGB. His book about it brought the idea of state-linked espionage over networks to a general audience.
From individuals to organizations
The Morris worm of 1988 showed that no one could treat an internet-connected computer as an isolated problem. Within days, a computer emergency response team was set up at Carnegie Mellon University, funded by the US defense research agency. Its model of collecting reports, publishing advisories and coordinating fixes spread to other countries and to large companies. Today most large organizations have a security team and a plan for incidents: how to detect an intrusion, contain it, restore systems and tell affected people.
In the 1990s the focus widened from the single machine to the network around it, with filtering gateways, and from stopping a threat to managing risk and cost. Vulnerability reporting, patch releases on a regular schedule and security audits became routine business practice.
A global concern
As economies came to rely on networks, the potential harm grew. Attacks on banks, hospitals, power systems and elections now appear in government planning documents. The Stuxnet worm, discovered in 2010, is widely reported to have targeted industrial equipment, and it is often cited as a sign that states build and use malicious code. Governments now publish national cybersecurity strategies, discuss rules for conduct in cyberspace and, in some countries, treat certain attacks as potentially serious as conventional ones. Opinions differ on how such rules should work, and the details are still debated.
What stayed the same
Passwords are still a common weak point, now supplemented by one-time codes and biometrics such as fingerprint scanners. New technologies keep adding new exposure, from cloud computing to connected sensors in homes and factories, and each brings familiar problems: default settings, unpatched software and people who can be tricked. The discipline began as a way of keeping users apart on one machine. Today it covers questions of privacy, safety and national policy, and the underlying lesson remains that security is as much about people and process as about technology.