Computer Security Institute

Computer Security Institute
Name	Computer Security Institute
Abbreviation	CSI
Formation	1974
Dissolved	2011
Type	Professional association
Purpose	Information security education and research
Headquarters	San Francisco, California
Region served	United States
Affiliations	Information Security Systems Association, International Information System Security Certification Consortium

Contents

Computer Security Institute was a United States–based professional association focused on information assurance, cybersecurity practice, and risk management. Founded in 1974, it served as a hub for practitioners, researchers, and policymakers from the private sector and public sector, fostering collaboration among entities such as National Institute of Standards and Technology, Federal Bureau of Investigation, Department of Defense, SANS Institute, and ISACA. The institute produced surveys, training, and conferences that connected participants from Silicon Valley, Wall Street, Pentagon, U.S. Congress, and international organizations including European Commission, United Nations, and Interpol.

History

The institute was established in the 1970s amid rising interest in computer security spurred by events like the Morris worm and regulatory initiatives such as the Computer Fraud and Abuse Act. Early decades saw collaboration with standards bodies like American National Standards Institute and International Organization for Standardization, while engaging with academia at institutions such as Massachusetts Institute of Technology, Stanford University, Carnegie Mellon University, University of California, Berkeley, and Princeton University. During the 1990s and 2000s the institute worked alongside corporations including IBM, Microsoft, Cisco Systems, Sun Microsystems, Intel, and Symantec to address vulnerabilities revealed by incidents like the ILOVEYOU worm and the Code Red worm. In the 2000s CSI partnered with certification organizations such as (ISC)² and CompTIA; its activities declined after 2010 amid consolidation with groups like the Information Security Forum and mergers affecting organizations such as BCS, The Chartered Institute for IT.

CSI offered professional development and advisory activities that engaged stakeholders including Chief Information Officers, Chief Information Security Officers, National Security Agency, Department of Homeland Security, and private firms like Goldman Sachs and Bank of America. Programs covered topics tied to compliance frameworks such as Health Insurance Portability and Accountability Act, Sarbanes–Oxley Act, Gramm–Leach–Bliley Act, and standards like ISO/IEC 27001 and NIST Cybersecurity Framework. Collaborative initiatives involved technology vendors Oracle Corporation, Amazon (company), Google, Verizon, and consulting firms like Deloitte, PricewaterhouseCoopers, Ernst & Young, and KPMG. CSI's training seminars frequently referenced legal precedents from courts such as the United States Court of Appeals for the Ninth Circuit and international rulings like those involving the European Court of Justice.

CSI published surveys, white papers, and incident reports that cited data from partners like CERT Division, Verizon Business, Ponemon Institute, IDC, and Gartner. Its annual survey analyzed breach metrics similar to studies by Verizon Data Breach Investigations Report and research from ENISA, RAND Corporation, Brookings Institution, Council on Foreign Relations, and Center for Strategic and International Studies. Contributors included academics from Columbia University, Harvard University, Yale University, University of Cambridge, and industry researchers from Bell Labs, AT&T Labs, and Microsoft Research. CSI reports informed policy debates in venues such as U.S. Senate Committee on Homeland Security and Governmental Affairs and international forums like NATO cybersecurity working groups.

CSI organized annual conferences and workshops that attracted participants from RSA Conference, Black Hat, DEF CON, OWASP, BSides, and InfoSec World. Events featured speakers from RSA Security, McAfee, FBI Cyber Division, U.S. Secret Service, European Central Bank, Bank for International Settlements, and academic panels with attendance by representatives of Harvard Kennedy School and Stanford Law School. Specialized tracks addressed topics raised by incidents including Stuxnet and policy efforts such as the Budapest Convention on Cybercrime. CSI collaborated with regional bodies in locations like San Francisco, New York City, London, Brussels, and Tokyo.

CSI maintained a board of directors drawing leaders from corporations like Accenture, Booz Allen Hamilton, Raytheon, Northrop Grumman, and nonprofit organizations such as Electronic Frontier Foundation and Center for Democracy and Technology. Advisory committees included experts affiliated with SANS Institute, (ISC)², ISSA International, and research centers at MITRE Corporation and Lawrence Berkeley National Laboratory. Funding sources combined membership dues from entities like Cisco Systems and Oracle Corporation, sponsorships from vendors such as Symantec and Microsoft, and grants involving agencies including National Science Foundation and Department of Defense research programs.

CSI influenced professional practice through its surveys and events, shaping dialogues across Wall Street, Silicon Valley, Pentagon, and international institutions like European Commission and United Nations Office on Drugs and Crime. Critics compared CSI to other industry groups such as ISACA and Information Systems Security Association on grounds of data methodology, transparency, and industry sponsorship, echoing critiques leveled at reports from Ponemon Institute and Verizon regarding sample bias and reporting standards. Debates around public–private cooperation referenced positions from Electronic Frontier Foundation, ACLU, and Privacy International concerning surveillance, incident disclosure, and civil liberties, while academic critiques from Stanford University and Carnegie Mellon University called for stronger empirical rigor in breach measurement.

Category:Information security organizations