Trusted Information Systems

Trusted Information Systems
Name	Trusted Information Systems
Type	Private
Founded	1983
Founders	Roger Schell
Fate	Acquired
Successor	Internet Security Systems
Headquarters	McLean, Virginia
Industry	Computer security

Trusted Information Systems was a U.S.-based information security company influential in the development of secure operating systems, formal evaluation, and trusted computing research. It contributed commercially and academically through products, papers, and participation in standards efforts associated with high-assurance systems and network security. The company intersected with prominent research labs, government initiatives, and commercial vendors shaping policy, evaluation, and technology adoption.

History

Founded in the early 1980s, Trusted Information Systems grew alongside projects at MITRE Corporation, SRI International, RAND Corporation, and Los Alamos National Laboratory. Its personnel collaborated with researchers at Carnegie Mellon University, Stanford University, Massachusetts Institute of Technology, and University of California, Berkeley while contributing to discussions at DARPA, National Security Agency, National Institute of Standards and Technology, and Department of Defense. The company released software and consulted on procurement influenced by the Orange Book and later the Common Criteria, working with contractors such as Boeing, Lockheed Martin, Raytheon, Northrop Grumman, and General Dynamics. During the 1990s it intersected with vendors like Sun Microsystems, IBM, HP, Microsoft, and Cisco Systems as commercial networking and UNIX systems demanded stronger assurance. Mergers and acquisitions involving Internet Security Systems, McAfee, and industry consolidation marked its later corporate trajectory. Its legacy is reflected in standards, academic citations, and follow-on companies and labs such as CERT Coordination Center and SANS Institute.

Definitions and Concepts

Trusted information systems employ notions from security engineering framed by formal methods and assurance frameworks developed by institutions like National Research Council, Institute of Electrical and Electronics Engineers, Association for Computing Machinery, and International Organization for Standardization. Concepts articulated by figures and programs at Bell Labs, RAND, NSA National Computer Security Center, and Defense Advanced Research Projects Agency include mandatory access control exemplified by work tied to Multics, CTSS, and TENEX lineage. Key notions reference models and authorities including Bell–LaPadula model, Biba model, Clark–Wilson model, and evaluation criteria such as TCSEC and Common Criteria. Cryptographic foundations draw on standards from RSA Laboratories, National Institute of Standards and Technology, and practitioners in projects at IETF, OpenSSL Project, and Internet Engineering Task Force.

Architecture and Components

Architectures featured kernel-level controls, auditing subsystems, and separation mechanisms influenced by projects at MITRE, SRI International, and vendors like Digital Equipment Corporation, Sun Microsystems, and IBM. Components commonly included trusted kernels, reference monitors, secure file systems, and cryptographic modules compliant with FIPS 140 standards; implementations referenced work at Bell Labs, Los Alamos National Laboratory, Argonne National Laboratory, and universities such as University of Cambridge and University of Oxford. Network-oriented components integrated technologies from Cisco Systems, Juniper Networks, and standards bodies including IEEE 802, IETF, and ISO/IEC. Identity and access modules aligned with federated identity protocols developed by OASIS, Liberty Alliance Project, and initiatives involving Microsoft, Oracle Corporation, and Google in enterprise settings.

Security Models and Evaluation Criteria

Trusted information systems applied security models like Bell–LaPadula model for confidentiality, Biba model for integrity, and Graham–Denning model for access control, while evaluation used Trusted Computer System Evaluation Criteria and later Common Criteria for Information Technology Security Evaluation. Assurance methodologies referenced formal verification techniques advanced at Harvard University, Princeton University, Cornell University, and ETH Zurich alongside toolchains from GNU Project and model checkers like SPIN (software) and theorem provers associated with Coq and Isabelle (proof assistant). Compliance and accreditation processes involved agencies and standards such as NSA, NIST, DoD, FIPS, and community-led initiatives like OWASP for web-facing components.

Applications and Use Cases

Deployments spanned critical infrastructure projects with contractors including Siemens, Schneider Electric, and General Electric as well as defense systems for U.S. Department of Defense programs and aerospace partners such as NASA and European Space Agency. Use cases included secure messaging linked to work by MITRE, secure remote access integrating technologies from SSH (Secure Shell), IPsec, and standards from IETF. Enterprise applications interfaced with databases and platforms from Oracle Corporation, Microsoft SQL Server, and middleware from IBM WebSphere and Red Hat. Financial sector adoption touched institutions like JP Morgan Chase, Goldman Sachs, Citigroup, and central banking systems influenced by standards bodies including Bank for International Settlements and SWIFT.

Standards and Certification

The field engaged with formal standards such as FIPS 140-2, FIPS 140-3, TCSEC, and Common Criteria, and participated in working groups within ISO/IEC JTC 1. Certification schemes involved testing laboratories accredited by NIST and accreditation bodies connected to NFPA and national schemes in United Kingdom, Germany, France, and Japan. Interoperability efforts referenced profiles and standards from IETF, W3C, OASIS, and sector-specific frameworks like IEC 62443 for industrial control and NERC CIP for energy.

Challenges and Future Directions

Contemporary challenges include integrating trusted architectures with cloud services led by Amazon Web Services, Microsoft Azure, and Google Cloud Platform while aligning with privacy initiatives from European Union bodies like European Commission and laws such as General Data Protection Regulation. Research directions tie to hardware roots-of-trust developed by Intel, AMD, ARM Holdings, and projects such as Trusted Platform Module and Intel SGX. Emerging intersections involve post-quantum cryptography advanced at NIST PQC Standardization and applied research at Quantum Research Center partners, secure supply chain work with National Cybersecurity Center of Excellence, and formal assurance integrated into continuous delivery pipelines promoted by DevOps advocates and firms like GitHub and GitLab. Cross-disciplinary collaboration with institutions such as World Economic Forum, International Telecommunication Union, and Global Forum on Cyber Expertise will influence policy, deployment, and standards evolution.

Category:Computer security