industry standards for interconnection of networks did not exist at that time. These de facto standards did little
to ensure the security of information though as these precursor technologies were widely adopted and became
industry standards, some degree of security was introduced. However, early Internet deployment treated
security as a low priority. In fact, many of the problems that plague e-mail on the Internet today are the result
of this early lack of security. At that time, when all Internet and e-mail users were (presumably trustworthy)
computer scientists, mail server authentication and e-mail encryption did not seem necessary. Early computing
approaches relied on security that was built into the physical environment of the data center that housed the
computers. As networked computers became the dominant style of computing, the ability to physically secure
a networked computer was lost, and the stored information became more exposed to security threats.
2000 to Present
Today, the Internet brings millions of unsecured computer networks into continuous communication
with each other. The security of each computer's stored information is now contingent on the level of security
of every other computer to which it is connected. Recent years have seen a growing awareness of the need to
improve information security, as well as a realization that information security is important to national
defense. The growing threat of Cyber-attacks have made governments and companies more aware of the need
to defend the computer-controlled control systems of utilities and other critical infrastructure. There is also
growing concern about nation-states engaging in information warfare, and the possibility that business and
personal information systems could become casualties if they are undefended.
What Is Security?
In general, security is "the quality or state of being secure—to be free from danger."11 In other
words, protection against adversaries—from those who would do harm, intentionally or otherwise—is the
objective. National security, for example, is a multilayered system that protects the sovereignty of a state, its
assets, its resources, and its people. Achieving the appropriate level of security for an organization also
requires a multifaceted system.
A successful organization should have the following multiple layers of security in place to protect its
operations:
Physical security, to protect physical items, objects, or areas from unauthorized access and misuse
Personnel security, to protect the individual or group of individuals who are authorized to access the
organization and its operations
Operations security, to protect the details of a particular operation or series of activities