National Computer Security Center

National Computer Security Center
U.S. government · Public domain · source
Name	National Computer Security Center
Formation	1981
Dissolution	2001
Predecessor	Computer Security Initiative
Successor	Common Criteria Project Management Office
Headquarters	Fort Meade, Maryland
Parent organization	National Security Agency
Jurisdiction	United States

National Computer Security Center The National Computer Security Center was a United States National Security Agency component established to develop standards, evaluations, and guidance for information-processing systems used in classified Department of Defense and civil applications. It coordinated technical evaluation criteria, certification processes, and research partnerships among agencies such as the National Institute of Standards and Technology, the Defense Advanced Research Projects Agency, and contractor communities including IBM, Hewlett-Packard, and Sun Microsystems. Over two decades the center influenced international standardization efforts involving the International Organization for Standardization, the European Union, and the United Kingdom's evaluation schemes.

History

The center was created in 1981 as part of the aftermath of the Cold War-era emphasis on secure computing initiated during the Carter administration and continuing through the Reagan administration. Early roots trace to the Multics project evaluations and to initiatives under the Department of Defense's Computer Security Initiative that followed breaches and exposures in the 1970s and 1980s, including incidents involving contractors for Pentagon systems and research programs linked to RAND Corporation analyses. During the 1980s the center worked closely with academic laboratories at Massachusetts Institute of Technology, Stanford University, and Carnegie Mellon University's Software Engineering Institute, and it adapted concepts from trusted computing research such as the Trusted Computer System Evaluation Criteria.

Throughout the 1990s the center responded to shifts prompted by commercial networking, the rise of the Internet, and policy changes during the Clinton administration. It engaged with international partners in bilateral talks with Canada, Australia, and members of the North Atlantic Treaty Organization to harmonize evaluation frameworks. The center was disestablished in 2001 as federal priorities moved to new accreditation models and joint international criteria, with assets and responsibilities transitioning to successor bodies.

Mission and Responsibilities

The center's mission included development of technical guidance, evaluation criteria, and certification processes to assure that information systems met designated assurance levels for processing sensitive and classified information. It produced evaluation methodologies that intersected with work at National Institute of Standards and Technology and compliance regimes related to the Federal Information Processing Standards and defense component accreditation. Responsibilities encompassed test lab accreditation, oversight of commercial product evaluations by vendors such as Microsoft, Novell, and Oracle Corporation, and collaboration with research institutions like Johns Hopkins University Applied Physics Laboratory and SRI International for advanced assurance techniques. The center served as a focal point for policy advice to agencies including the Central Intelligence Agency, the Federal Bureau of Investigation, and the United States Air Force.

Organizational Structure

Organizationally the center was organized into divisions for evaluation, research, policy, and outreach. The evaluation division worked with independent evaluation laboratories and contractors like Trusted Information Systems and Boeing's information security units; the research division coordinated projects with university centers such as University of California, Berkeley and University of Cambridge; the policy division liaised with federal entities including the Office of Management and Budget and congressional oversight committees; and the outreach office handled industry relations with vendors like Digital Equipment Corporation and standards bodies such as the Internet Engineering Task Force. Leadership typically comprised senior National Security Agency officials with backgrounds in computer security, cryptography, and systems engineering, engaging technical advisory panels drawn from Defense Science Board members and academic experts.

Major Programs and Publications

Prominent outputs included operationalized versions of the Trusted Computer System Evaluation Criteria (often called the "Orange Book") and related companion documents such as the "Pink Book" guidance for networked systems. The center produced evaluation reports, product protection profiles, and methodology manuals that shaped product development across vendors including Apple Inc., Cisco Systems, and Sun Microsystems. It sponsored conferences and workshops with organizations like IEEE and ACM and disseminated position papers that influenced standards work at the International Organization for Standardization and the International Electrotechnical Commission. The center also published evaluation checklists, vulnerability notes, and compliance guidance used by operators in agencies such as the Department of Energy and National Aeronautics and Space Administration.

Notable Incidents and Influence

The center was involved in high-profile evaluations during episodes that drew public attention to computer security requirements, including product disputes and disclosure debates involving vendors such as Microsoft and IBM. It played roles in responses to vulnerabilities that affected systems used by the Defense Intelligence Agency and in advisory capacities during major information assurance controversies in the 1990s, interacting with congressional inquiries and panels chaired by figures associated with Senate Armed Services Committee hearings. Its criteria informed acquisition requirements for large procurements by the Federal Aviation Administration and Department of the Treasury, and its influence extended to judicial and legislative discussions around export controls tied to cryptography, which intersected with actors like Phil Zimmermann and policy venues in the Department of Commerce.

Legacy and Successor Organizations

After 2001 the center's legacy persisted through multinational efforts culminating in the Common Criteria framework and the establishment of coordination offices such as the Common Criteria Project Management Office and national certification schemes in countries like Canada and the United Kingdom. Many practices pioneered by the center—evaluation labs, protection profiles, and assurance levels—were absorbed into standards maintained by National Institute of Standards and Technology and by international consortia including the Internet Engineering Task Force and European Network and Information Security Agency. Alumni of the center moved into leadership roles in industry, academia, and agencies such as the Department of Homeland Security and the Office of the Director of National Intelligence, perpetuating technical culture and evaluation disciplines developed during the center's tenure.

Category:United States intelligence agencies Category:Computer security