James P. Anderson Jr.

James P. Anderson Jr.
Born1930
Easton, Pennsylvania, United States
DiedNovember 18, 2007(2007-11-18) (aged 77)
Pennsylvania, United States
EducationPennsylvania State University
Known forReference monitor concept
Audit trail-based intrusion detection
Burroughs D-825 multiprocessor
The Anderson Report (1972)
Scientific career
FieldsComputer security
Cryptography
Parallel computing
WorkplacesUNIVAC
Burroughs Corporation
Auerbach Corporation
James P. Anderson Company

James P. Anderson Jr. (1930 – November 18, 2007) was an American computer scientist regarded as one of the founding figures of information security. He is generally credited with the invention and explication of the reference monitor concept (1972) and the formulation of audit trail-based intrusion detection (1980), two ideas that became foundational to the modern discipline of computer security.

Early life and education

Anderson was born in Easton, Pennsylvania and graduated from the Pennsylvania State University with a degree in meteorology.[1][2] From 1953 to 1956, he served in the United States Navy as a gunnery officer and later as a radio officer; his time as a radio officer first drew him into the study of cryptography and information security.[1][2]

Career

In 1956, Anderson took his first computing job at the Univac division of Remington Rand, where he was hired by John Mauchly to program meteorological data; Mauchly became a personal mentor and family friend.[2] In 1959, he joined the Burroughs Corporation as manager of the Advanced Systems Technology Department in the company's research division, where he worked on compiler design, parallel computing, and computer security.[1][2]

While at Burroughs, Anderson was one of the principal architects, and a named patent holder, of the D-825, a modular military data processing system.[1][3][4] The D-825 was first delivered to the United States Naval Research Laboratory under the military designation AN/GYK-3(V) and was also used in the AN/GSA-51 BUIC II air-defense system.[3]

From 1964 to 1966, Anderson served as manager of systems development at Auerbach Corporation.[1][2] In 1966, he founded his own consulting firm, the James P. Anderson Company, based in Fort Washington, Pennsylvania, which he operated until his retirement in August 2007.[2][5] Through that firm, he became a long-standing consultant to computer manufacturers, defense and intelligence agencies, and telecommunications carriers.[2]

Contributions to information security

Ware Report (1968–1970)

Anderson was a participant on the 1968 Defense Science Board Task Force on Computer Security, chaired by Willis Ware of the RAND Corporation.[1][2] Its 1970 report, popularly known as the Ware Report, framed the technical challenges of providing security in time-sharing computer systems and is generally considered the first systematic governmental statement of the computer security problem.[1]

The Anderson Report (1972)

In 1972, Anderson served as deputy chair and editor of a follow-on study commissioned by the U.S. Air Force Electronic Systems Division, formally titled Computer Security Technology Planning Study (ESD-TR-73-51) and widely known as the Anderson Report.[6][7] The study panel included Daniel J. Edwards of the National Security Agency, Steven Lipner of The MITRE Corporation, and Clark Weissman of the System Development Corporation, among others.[8]

The report introduced the reference monitor concept, an abstract mechanism that mediates every access by a subject to an object in a system, as the basis for building demonstrably secure operating systems.[9] The report's reference monitor formulation directly shaped later security kernel architectures, the Bell–LaPadula model, and the U.S. Trusted Computer System Evaluation Criteria (TCSEC, the "Orange Book").[7][9] Anderson defined the term "malicious user", an authorized user who attempts to exploit design or implementation flaws to gain supervisory control of the system, as the central threat for which multilevel secure systems had to be engineered.[7]

According to a 2008 note by computer scientist Peter J. Denning, Anderson himself credited the specific term "reference monitor" to a 1972 AFIPS Spring Joint Computer Conference paper co-authored by Denning and G. Scott Graham, while Anderson is credited with recognizing the concept's fundamental importance for security practice and championing its adoption.[2]

Intrusion detection (1980)

In April 1980, Anderson published a technical report for a U.S. government client, Computer Security Threat Monitoring and Surveillance (Contract 79F296400), through the James P. Anderson Company.[5] The report is generally regarded as the founding document of intrusion detection: it proposed using the audit logs of time-sharing systems, analyzed by a separate surveillance program against statistical user profiles, to detect masqueraders, misfeasors, and clandestine users.[5][10][11] The taxonomy of insider and outsider attackers introduced in the report, including external penetrators, internal masqueraders, and misfeasors, is still cited in modern intrusion-detection literature.[12]

Anderson's 1980 report directly inspired Dorothy E. Denning and Peter G. Neumann's work at SRI International in 1984–1986, which produced the first real-time Intrusion Detection Expert System (IDES), and through it the entire family of host-based and network-based intrusion-detection systems developed in the 1980s and 1990s.[10][13]

Other government work

Anderson contributed to a number of other seminal U.S. government information security standards and policies, including the Trusted Computer System Evaluation Criteria (TCSEC, the Orange Book), the BLACKER secure-networking program, the Trusted Network Interpretation (TNI), and other volumes in the National Computer Security Center's Rainbow Series.[1][2][14]

Awards and recognition

In 1990, Anderson received the National Computer Systems Security Award from the National Institute of Standards and Technology and the National Computer Security Center (then part of the National Security Agency).[1][15] He was the third recipient of the award, following Stephen T. Walker (1988) and Willis Ware (1989), and preceded Roger Schell (1991), Dorothy E. Denning (1999), and Eugene H. Spafford (2000).[15]

Selected works

  • Anderson, James P.; Hoffman, Samuel A.; Shifman, Joseph; Williams, Robert J. (1962). "D825 - a multiple-computer system for command & control". Proceedings of the December 4–6, 1962, Fall Joint Computer Conference – AFIPS '62 (Fall). Association for Computing Machinery: 86–96. doi:10.1145/1461518.1461527.
  • Anderson, James P. (October 1972). Computer Security Technology Planning Study, Volumes I and II (Report). Electronic Systems Division, Air Force Systems Command, Hanscom Field, Bedford, Massachusetts. ESD-TR-73-51.
  • Anderson, James P. (April 15, 1980). Computer Security Threat Monitoring and Surveillance (Report). James P. Anderson Co., Fort Washington, Pennsylvania. Contract 79F296400.

References

  1. 1 2 3 4 5 6 7 8 9 Spafford, Eugene (January–February 2008). "In Memoriam: James P. Anderson – An Information Security Pioneer" (PDF). IEEE Security & Privacy. 6 (1): 9. doi:10.1109/MSP.2008.15.
  2. 1 2 3 4 5 6 7 8 9 10 Spafford, Eugene (January 2, 2008). "Passing of a Pioneer". Center for Education and Research in Information Assurance and Security (CERIAS), Purdue University.
  3. 1 2 Anderson, James P.; Hoffman, Samuel A.; Shifman, Joseph; Williams, Robert J. (1962). "D825 - a multiple-computer system for command & control". Proceedings of the December 4–6, 1962, Fall Joint Computer Conference – AFIPS '62 (Fall). Association for Computing Machinery: 86–96. doi:10.1145/1461518.1461527.
  4. ↑ "The History of the Development of Parallel Computing". Virginia Tech Department of Computer Science.
  5. 1 2 3 Anderson, James P. (April 15, 1980). Computer Security Threat Monitoring and Surveillance (PDF) (Report). James P. Anderson Co., Fort Washington, Pennsylvania. Contract 79F296400.
  6. ↑ Anderson, James P. (October 1972). Computer Security Technology Planning Study (PDF) (Report). Vol. I and II. Electronic Systems Division, Air Force Systems Command, Hanscom Field. ESD-TR-73-51.
  7. 1 2 3 "A Tribute to a Change Agent: James P. Anderson". Fortra. December 15, 2014.
  8. ↑ Anderson, James P. (October 1972). Computer Security Technology Planning Study, Volume II (Report). Electronic Systems Division, Air Force Systems Command, Hanscom Field. ESD-TR-73-51, Vol. II.
  9. 1 2 Kemmerer, Richard A. "Computer Security". Encyclopedia of Computer Science (PDF). John Wiley & Sons.
  10. 1 2 "Intrusion Detection: Evolution from Anomalous Behavior Pattern Matching". Global Information Assurance Certification (GIAC).
  11. ↑ "The History and Evolution of Intrusion Detection". Global Information Assurance Certification (GIAC).
  12. ↑ McHugh, John. An historical analysis of factors contributing to the emergence of the intrusion detection discipline (PDF) (Report). Defense Technical Information Center.
  13. ↑ Yost, Jeffrey R. (October 2016). "The March of IDES: Early History of Intrusion-Detection Expert Systems". IEEE Annals of the History of Computing. 38 (4): 42–54. Bibcode:2016IAHC...38d..42Y. doi:10.1109/MAHC.2015.41.
  14. ↑ "Trusted Network Interpretation Environments Guideline (NCSC-TG-011)". Federation of American Scientists. National Computer Security Center.
  15. 1 2 Spafford, Eugene. "The NCSS Award". CERIAS, Purdue University.
This page is issued from Wikipedia. The text is available under Creative Commons Attribution-Share Alike 4.0 unless otherwise noted. Additional terms may apply for the media files.