title: Trusted...or...trustworthy: the search for a new paradigm for computer and network security
abstract: This paper sets out a number of major questions and challenges which include: (a) just what is meant by `trusted' or `trustworthy' systems after 20 years of experience, or more likely, lack of business level experience, with the 'trusted computer system' criteria anyway; (b) does anyone really care about the adoption of international standards for computer system security evaluation by IT product and system manufacturers and suppliers (IS 15408) and, if so, how does it all relate to business risk management anyway (IS 17799); (c) with the explosion of adoption of the microcomputer and personal computer some 20 years ago, has the industry abandoned all that it learnt about security during the `mainframe era'; or - `whatever happened to MULTICS' and its lessons; (d) has education kept up with security requirements by industry and government alike in the need for safe and secure operation of large scale and networked information systems on national and international bases, particularly where Web or Internet-based information services are being proposed as the major `next best thing' in the IT industry; (e) has the `fourth generation' of computer professionals inherited the spirit of information systems management and control that resided by necessity with the last `generation', the professionals who developed and created the applications for shared mainframe and minicomputer systems?
keyphrases: network security international standards IS 15408 business risk management IS 17799 microcomputer personal computer MULTICS education Web Internet-based information services information systems management computer security trusted systems trustworthy systems IT manufacturers large scale information systems fourth generation computer professionals information systems control