A Technical History of the SEI

Introduction to Security
In the early days, security was not high on the list of issues facing software engineers, even for
those involved in DoD systems, except for those who developed software for classified systems.
At best, most used defensive techniques aimed at surviving mistakes users might make. They seldom
concerned themselves with the possibility that someone with malicious intent might subvert
their systems.
This was particularly true of the internet, which was spawned from the ARPANET [Leiner 2012,
Museum 2006]. The ARPANET began as a research-oriented development to offer packet switching
as a new paradigm in network construction—it was a research project for researchers. The underlying
technology was developed with an open, trusting style. Everyone was expected to be a
friendly user. Indeed, there was a culture of cooperation and a willingness to contribute fixes for
common problems that was self-regulating.
Initially, the expansion of the ARPANET to the internet simply expanded the user community to a
broader segment of the research community. However, once the commercial potential was realized,
the rapid growth led to a user profile that more closely reflects the general population. Unfortunately,
the general population includes mischievists, thieves, and criminals.
Several people, including those who developed the underlying technology, warned that the internet
was not intended to be secure and that there was a serious potential for abuse. Although
DARPA began investigating security solutions [FAS 2000], there was little concern among users
because there was no “smoking gun”—no indication that anyone would seriously attack the internet
or systems on the internet. While there were some attacks, there was still no clear indication of
a persistent threat and, therefore, no serious attention given to security.
Genesis of the CERT Coordination Center
That ambivalence was rudely shaken on November 2, 1988, when a graduate student released a
worm on the internet [ACM 1989]. The Morris Worm (named for its inventor) brought the internet
to its knees. For the 72 hours after the release of the worm, the research community, coordinated
by two program managers at DARPA, reverse engineered the worm to understand how it
functioned, then began to provide advice to systems administrators on removing the worm. Communication
was hampered because the worm clogged the network, the primary means of communication
for many sites. Moreover, many sites removed themselves from the ARPANET altogether,
further hampering communication and the transmission of the solution that would stop the
worm. Although the ad hoc collaboration of experts from around the country was effective in defeating
the worm, DARPA realized that the worm, though destructive, was reasonably benign in
relation to havoc it might have wreaked if Morris had been more malicious. DARPA management
knew that there would certainly be more malicious attacks in the future and, the following week,
asked the SEI to propose a mechanism that would encourage and support collaboration among
technical experts in resolving security problems, and coordinate their response activities in the
event of future attacks against the internet and connected systems.
CMU/SEI-2016-SR-027 | SOFTWARE ENGINEERING INSTITUTE | CARNEGIE MELLON UNIVERSITY 161
Distribution Statement A: Approved for Public Release; Distribution is Unlimited.