Ware report explained

Security Controls for Computer Systems, commonly called the Ware report,^[1] is a 1970 text by Willis Ware that was foundational in the field of computer security.^[2]

Development

A defense contractor in St. Louis, Missouri, had bought an IBM mainframe computer, which it was using for classified work on a fighter aircraft. To provide additional income, the contractor asked the Department of Defense (DoD) for permission to sell computer time on the mainframe to local businesses via remote terminals, while the classified work continued.

At the time, the DoD did not have a policy to cover this. The DoD's Advanced Research Projects Agency (ARPA) asked Ware - a RAND employee - to chair a committee to examine and report on the feasibility of security controls for computer systems.^[3]

The committee's report was a classified document given in January 1970 to the Defense Science Board (DSB), which had taken over the project from ARPA. After declassification, the report was published by RAND in October 1979.^[4]

Influence

The IEEE Computer Society said the report was widely circulated,^[1] and the IEEE Annals of the History of Computing said that it, together with Ware's 1967 Spring Joint Computer Conference session, marked the start of the field of computer security.^{[2] [5]}

The report influenced security certification standards and processes, especially in the banking and defense industries, where the report was instrumental in creating the Orange Book.^[6]

Notes and References

1. Web site: Willis Howard Ware. Security Controls for Computer Systems, tech. report R-609-PR, RAND, Defense Science Board Task Force on Computer Security, 1972. R-609- 1-PR was reissued Oct. 1979. This widely circulated report was informally known as 'the Ware report.'. IEEE Computer Society. 2020-12-20.
2. Computer Security Discourse at RAND, SDC, and NSA (1958-1970). The 1967 Spring Joint Computer Conference session organized by Willis Ware and the 1970 Ware Report are widely held by computer security practitioners and historians to have defined the field's origin. . Thomas J. . Misa. 1058-6180. 38. 4. October–December 2016. IEEE Annals of the History of Computing. 12–25 . IEEE Computer Society. 10.1109/MAHC.2016.48 . 17609542 .
3. Willis Ware (chair), 1967 Defense Science Board Study. Problem: Significant number of systems being acquired for military use. Charge: Formulate recommendations for hardware and software safeguards to protect classified information in multi-user, resource-sharing computer systems.. Computer Security from the Trojan Wars to the Present. Charles P. . Pfleeger. October 10, 2000 . 23rd National Information Systems Security Conference. Baltimore, Maryland, United States. Proceedings of the 23rd National Information Systems Security Conference. NIST. https://csrc.nist.gov/publications/detail/conference-paper/2000/10/19/proceedings-of-the-23rd-nissc-2000.
4. Book: Ware, Willis H.. Willis Ware. RAND Corporation. 978-0-8330-4513-3. 2008. RAND and the information evolution : a history in essays and vignettes.
5. The 1970 (Willis H.) Ware Report and the 1967 Spring Joint Computer Conference (SJCC) Ware-led 'Computer Security and Privacy' session are focal points of historians and computer security scientists and are generally considered the beginning of multilevel computer security.. Computer Security, Part 2. https://web.archive.org/web/20190220035817/http://pdfs.semanticscholar.org/1ef3/d20ebbeb9ba40136d29a2cf04b2bd0fbd4c7.pdf. dead. 2019-02-20. Jeffrey R. . Yost. 10.1353/ahc.2016.0040. 10–11. 38. 4. October–December 2016. IEEE Annals of the History of Computing. IEEE Computer Society. 35453662.
6. How Certification Systems Fail: Lessons from the Ware Report. IEEE Security & Privacy. 10. 6. 40–44. Nov–Dec 2012. 10.1109/MSP.2012.89. The heritage of most security certification standards in the banking industry can be traced back to ... 'Security Controls for Computer Systems' (commonly known as the Ware Report...), focussed on the problem of protecting classified information in multi-access, resource-sharing, computer systems which were at the time being increasingly used by both the government and defense contractors. The report included not only recommendations for what security functionality such systems should have in order to safely process classified information, but also proposed certification procedures for verifying whether a system meets these criteria. These certification procedures formed the basis for the Trusted Computer System Evaluation Criteria (TCSEC). The requirements and assessment criteria for TCSEC are given in 5200.28-STD, colloquially known as the 'Orange Book', but that publication is augmented by others in the 'Rainbow Series', expanding and clarifying various aspects.. Murdoch. Steven. Bond. Mike. Anderson. Ross J.. 20231.