Security Evaluation and Testing - Past, Present and Future

IT Security Evaluation started with the US DoD Trusted Computer Security Evaluation Criteria — commonly known as ‘The Orange Book’ — in 1983. This was the original and seminal work in this field. Even though it was based on research conducted in the late 1970s (The Bell-Lapadula Model), it remained the predominant standard for some 10 years until overtaken by the European IT Security Evaluation Criteria (ITSEC). The need for a common international standard drove the development of the Common Criteria, which has now been the predominant standard for 10 years.