At what point did computing go from mainly performance- and functionality-oriented to security-oriented? Why? [closed]

Question

I realize this question may have a different answer for each field of computing (enterprise vs. business vs. personal vs. field equipment), but there should still be an objective point in time where this transition took place for each field of computing, and that's the goal of this question, knowing when that time was and what the events surrounding it looked like.

Back in the early days of (at least personal) computing, it seems like security wasn't much of a concern at all. Pretty much everything ran as "administrator" (or whatever the equivalent was for the machine in question), applications could read and write to wherever they wanted in RAM, a single buggy application could crash the entire system (looking at cooperative multitasking, yuck), and data was usually transmitted unencrypted. Even some systems designed to be somewhat multi-user (CP/M in particular) lacked all security - one could just switch to someone else's user and have full access to their stuff. The closest thing I can see to security in these old days of computing (at least for personal computing) was some simplistic forms of DRM (like the NES used for region locking). And even that didn't work particularly well.

Contrast this with modern-day computing, where well nigh everything that gets transmitted over the Internet is encrypted so strongly that even the most powerful computers known today can't break into it in a reasonable time span, security vulnerabilities are a big deal, systems are designed for multiple users and have privilege isolation, etc., etc. Even CPUs may have extra security features built into them (like Intel's SGX). It's become just part of how computing works.

I've not used enough old computers to know for sure, but AFAICT, in Windows, the transition from pure functionality-based computing to security-based computing happened somewhere around the time of Windows 2000, which had Administrator, Power User, and User security levels (IIRC), and an entire page in the Help manual on why using an Administrator account all the time was a bad idea. (Contrast this with Windows 95, which only had a username and password for logging you into the network, and would just give you total admin privileges to the physical system if you clicked "Cancel"...) I also remember reading about HTTPS and the now-obsolete S-HTTP in a very old HTML book (like, CSS was competing with DSSSL, old).

When did security really start becoming "on the radar" in the world of computing, and why? Was there ever a transition like this in the world of business computing (servers and mainframes), or have those always been security-oriented? What were some of the first security features, and what inspired their creation?

Edit: Also just realized another core part of the equation here - CPUs used to just be made faster and faster as technology and innovation would allow... which ultimately led to the mess we now know as Spectre/Meltdown (to the best of my knowledge). Now we have to be careful with these kind of things, oftentimes accepting dramatic performance cuts in so doing.

Answer 1

I think you're looking at this from the wrong angle.

It makes more sense to look at it from the perspective of "When did technology from the more enterprise tiers start to flow into the mainstream?"

Things like CP/M, MS-DOS, Windows 3.1x/9x, etc. are products of a world with microcomputers that aren't networked aside from the occasional transient dial-up call to something like a BBS or office server.

I don't know about the earliest entries, but time-sharing operating systems have had user access controls and user/administrator privilege separation since, if not the beginning of interactive computing, then very close. We're talking the 1960s.

Prior to that, security was achieved by having only the trusted humans interact with the computer, and only enter batch jobs that had been vetted.

Windows 2000 was when you started to see security and privilege separation become significant because it was when the Windows NT line started to reach feature parity with the Windows 9x line for non-business stuff like 3D acceleration, and Windows NT had been designed as a multi-user competitor to systems like UNIX, based on VMS heritage.

(It also helped that enough of the typically-in-use software and hardware drivers had shifted to the Win32 APIs that switching to an NT kernel with more privilege isolation wouldn't be as likely to break what people were already running.)

Windows 3.1 had a counterpart with user accounts and privilege separation in the short-lived Windows NT 3.1 (screenshots) and then Windows NT 3.51 (screenshots) ... it just required significantly beefier hardware and wasn't much more compatible with the random hardware drivers and DOS software you already owned than Linux was in the early 2000s.

As for why the transition occurred, probably because the Internet burst into public consciousness during 1995 and 1996 and, by 2000, it was starting to become apparent to both good guys and bad guys that something more robust was needed for machines exposed to a global network and/or downloading random software off random websites.

(Plus, by 2000, hardware had advanced enough that the resource cost of improved security wasn't so painful anymore.)

Answer 2

The change over happened when computers were exposed to network environments.

Early multi user systems implemented security out of necessity, so that users couldn't interfere with each other. Enterprise customers were doing that back in the 60s.

On the personal computer front, corporations adopted networks in the 80s and early 90s, Novell NetWare brought security to DOS and Windows machines, again out of necessity. Later Microsoft took over that market with more secure versions of Windows.

For home users the network that really spurred the change was the internet. Malware became a huge problem for single user operating systems with no security model.

Answer 3

When did cars start adding door locks? :D (rhetorical)

I used to be a BBS SysOp in the 1980s. Everything was plain text, when callers (users) made accounts, I saw their passwords. In fact, when I migrated from one BBS software to another, sometimes I would manually re-create people's accounts (and enter their passwords) -- with just a few hundred accounts, that was faster than trying to write some data conversion utility (and sometimes didn't have source code for the new system).

Also I could see what any connected user was doing -- as they were typing things. And I could hit a hotkey to "jump into chat" with a connected user. There was a PAGE option, that would make my system beep if someone needed to get a hold of me and get my attention. Or if I saw a user was struggling to find a file or get a download going, or some kind of issue, I could jump in and try to help them.

I hear what the OP is saying - there was a transition. And it bugs me that as soon as computing power is there to do a certain thing, now it suddenly becomes a legal imperative to have it done. In other words, when a CPU was so slow, encryption wasn't important. It was just an "honor system" when using those online systems. And users should use good judgement and not use important credentials (or not use the same credentials for each system). I'm not aware of any "corrupt SysOp" that abused that trust - but I suspect somewhere it did happen (like a SysOp then "posing" as that user, or trying to use that same password on other systems).

Anyhow, I think the transition was for two reasons: (1) CPUs were slow back then. Early microcomputers could barely maintain the asynchronous connection and run your terminal emulator program, let alone do anything like compression or encryption on the fly. We're talking 1-4 MHz CPUs. (2) Nobody was doing online banking back then. If you wanted to do business, you gave your home phone number, and mailed checks. My first experience on the internet was Mosaic, AltaVista, and some Gopher searches - probably on OS/2 in 1994 (and I recall it cost $100 for that couple hours of surfing). In order to start doing e-commerce, people needed to trust the system was encrypted from just wiresharking people's credit card numbers. eBay started maybe around 1996? 1997-ish? We still mailed checks/money orders for awhile, but online banking was coming -- and by then Pentium and 100+ MHz systems were typical. Remember Stacker? On the fly compression to save disk space - Microsoft stole their idea and made it part of MS-DOS. Anyhow, if we could do on-the-fly compression/decompression, the CPUs could also do on-the-fly encryption.

Now... as far as user accounts, such as on a home PC... Recall Unix/Linux had those three tiers of policies like from day 1 (that octal code on every folder and file, or 777 to just open it up). MS-DOS (or 86-DOS) never had that. I think either DR-DOS, or third-party DOS extensions, could add some login stuff during bootup. I don't even recall logins for OS/2 or Windows for Workgroups (they probably had options for it, but not by default). I guess it was Vista, c2007/2008 the first time I had to think about a user account at home. BUT - these days we do hold a lot of personal information on our PCs, and in case anyone breaks in and steals your PC, it definitely is good practice to have an encrypted drive and secured login. I think in the 1980s, "most" (hopefully) had backups of anything important back on a floppy disk - but that was mostly because hard drives were unreliable, when they started going bad, they'd go bad quickly (as in bad sectors). These days hard drives are so reliable, and to some extent "self healing" (marking bad sectors and relocating the data on the fly), I don't know anyone "backs up" stuff to a CD or SD-card anymore (maybe some use cloud -- I mirror stuff to a NAS).