# Safety and Security Considerations for Online Laboratory Management Systems
## 3 Literature Review
### Computer Safety and Security Evolution  
#### 3.2.1 Security  
In October 1967, the US Department of Defense (DoD) [18] created a working group to tackle security issues concerning classified data in computer systems intended for remote access and resource sharing. In collaboration with the National Computer Security Center (NCSC) [19], they released a set of security evaluation criteria known as the _Orange Book_, or _Trusted Computer System Evaluation Criteria_ (TCSEC) [20]. The NCSC's role was to conduct product evaluations based on these criteria. The objective of the _Orange Book_ was to specify the functionalities at assurance levels to mitigate defined levels of risk. This framework supported the creation of operating systems that ensured compliance with US government standards [21]. The _Orange Book_ is part of a series of documents published by the DoD, known as the _Rainbow Series_, which were issued in 1983, updated in 1985, and later replaced by the Common Criteria international standard in 2005 [22].  
In the United Kingdom, a similar initiative emerged in 1982 when the Communications-Electronics Security Group (CESG) [23] was appointed as the national authority overseeing government systems handling classified information. CESG developed a comprehensive set of criteria for evaluating complete systems, including physical, personnel, and administrative aspects. Their evaluation framework became operational in 1984. In 1987, the Department of Trade and Industry (DTI) [24] established the Commercial Computer Security Centre (CCSC) [25] to advance the UK industry's interests. The CCSC developed globally recognized security evaluation criteria for various product categories and market sectors to achieve this. The CCSC recognized the value of refining the _Orange Book_ by separating its security functionality requirements from its assurance prerequisites. CESG and many other countries supported this approach, including France, Germany, the Netherlands, and Canada. The goal was to enable the creation of both straightforward, highly secure products, like cryptographic devices, and more complex systems, such as databases, with appropriately scaled assurance levels. Additionally, the Commission of European Communities [26] published the _Information Technology Security Evaluation Criteria_ (ITSEC) [27], which incorporated security evaluation standards from France, Germany, the Netherlands, CESG, and the CCSC. These countries also developed the _Information Technology Security Evaluation Manual_ (ITSEM), which provided the technical foundation for the evaluation process and its certification [21].  
On the other hand, in 1990, the US Computer Security Act [28] granted authority to the US National Institute for Standards and Technology (NIST) [29], mirroring the powers held by the UK's DTI. As a result, NIST formed a similar partnership with the National Computer Security Center (NCSC) [30], akin to the DTI's collaboration with CESG. Meanwhile, as the ITSEC and ITSEM frameworks evolved, NIST initiated the US Federal Criteria. At the same time, Canada introduced its criteria, distinguishing between functionality and assurance while identifying key security functional components and offering guidance on their integration. The US viewed ITSEC as the first step toward an international standard, with the Canadian criteria following as the subsequent development [21].