1. Brief Synopsis of Computer Security Standards

2. Tenets of Information Systems Security Confidentiality Integrity Availability Over the years, standards and legislation have been created to support the tenets of information systems security.

3. 1968 NBS National Bureau of Standards does a study of US Government's computer security needs.

4. 1972 NBS & ACM NBS in collaboration with ACM (Association for Computing Machinery) sponsor their first conference on computer security

5. 1974 TEMPEST Establishes standards for shielding eminations

6. 1977 NBS & ANSI NBS sponsors workshops to audit and evaluate computer system security. ANSI (American National Standards Institute) adopts DES, the data encryption standard. This is the official standard encryption for unclassified data 1986 NSA no longer endorses DES

7. 1980 Computer Security Center Department of Defense establishes the Computer Security Center within the NSA

8. 1983 TCSEC Orange Book Release DOD releases the “Trusted Computer System Evaluation Criteria”, TCSEC Affectionately known as the “Orange Book”, because of its orange cover. Revised in 1985 Retired in 2002

9. 1984 NSTISSP National Security on Telecommunications and Automated Information Systems Security, gave the NSA the authority to advise the private sector on computer security http://www.fas.org/irp/offdocs/nsdd145.htm

10. 1986 Computer Fraud and Abuse Act Establishes legal action against unauthorized or fraudulent access to government computers and electronic data.

11. 1987 Computer Security Act Government agencies must have a well defined information system security plan

12. Common Criteria Developed during the 1990s in Europe then established later in Canada. Superseded the TCSEC (Orange Book) circa 2002.

13. 1996 HIPAA Health Insurance Portability and Accountability Act Among other things, it establishes standards for electronic health care transactions Establishes the importance of privacy and security for health care data

14. 1999 Gramm Leach Bliley Act Contains a financial privacy rule requires financial institutions to design, implement, and maintain safeguards to protect customer information.

15. 2002 SOX Sarbanes-Oxley Among other things, impacts internal controls of data relevant to the auditing of records belonging to publicly traded companies.

16. 2002 FISMA Federal Information Security Management Act Each federal agency must develop, document, and implement an agency wide security program to protect their information systems data and infrastructure.

17. 2004 PCI SSC Payment Card Industry Security Standards Council Establishes a minimum level of security for merchants and card issuers

18. 2009 HITECH Act Heath Information Technology for Economic and Clinical Health Designed to further support HIPAA rules. Addresses privacy and security concerns associated with the electronic transmission and storage of health information.