Abstract: The market for information security has long been seen as dysfunctional. For customers to make rational tradeoffs of security and risk, they need accurate information about the products and systems they are planning to purchase, and this information is hard to come by. Although this may seem a modern observation, it was the basis more than 20 years ago for the creation of the Trusted Computer System Evaluation Criteria (known as the "Orange Book"), whose descendant, the Common Criteria, is in use today. In many respects, this development can be seen as an attempt to improve the flow of information in the information security market. This talk will review the motivations behind creation of the Orange Book and its accompanying institutions, the experience with them over a 20-year period, and relate them to the policies in place today.

Biography: Carl Landwehr joined NSF on October 15, 2001, as Program Director for the newly established Trusted Computing program. He is an IPA from Mitretek Systems, where he is Senior Fellow in the Security and Privacy Technical Center. Prior to joining Mitretek, he headed the Computer Security Section of the Center for High Assurance Computer Systems at the Naval Research Laboratory for many years, where he led a variety of research projects to advance technologies of computer security and high-assurance systems. He has also served on the computer science faculty at Purdue University, and he has taught courses on topics in computer science and information security at Georgetown, the University of Maryland, and Virginia Tech. He received a Bachelor of Science degree in Engineering and Applied Science from Yale University and M.S. and Ph.D. degrees in Computer and Communication Sciences from the University of Michigan.

Dr. Landwehr has served on the editorial boards of IEEE Transactions on Software Engineering, the Journal of Computer Security, and the High Integrity Systems Journal. He was the founding chair of IFIP Working Group 11.3 on Database Security, and has also chaired the IEEE Technical Committee on Security and Privacy. IFIP has awarded him its Silver Core, and the IEEE Computer Society has awarded him its Golden Core. His current research interests include information security and dependable systems.