James P. Anderson

James P. Anderson was an early computer-security researcher and consultant. He led the Computer Security Technology Planning Study for the U.S. Air Force, published in 1972 and commonly called the Anderson Report.

The Anderson Report

The report examined the security problems created by shared, multi-user computing. It treated a malicious user as a central design threat, described hostile penetration of systems, and set out research and engineering work needed for more secure computing.

That makes Anderson an important precursor to modern penetration testing: the report did not use today's commercial vocabulary or tooling, but it placed deliberate attempts to penetrate a system within a systematic security-assurance program.

Enduring influence

The study also discussed multilevel security, security kernels, certification techniques, and security surveillance. Those subjects became durable parts of computer-security engineering and evaluation. Anderson should therefore be described as a foundational pioneer of computer security and penetration analysis, rather than assigned an unqualified single-person title for a field developed by many researchers and practitioners.

In memoriam

Anderson's work remains a point of reference for the idea that systems must be tested against capable, intentional adversaries—not merely checked for accidental failures.

Timeline

• 1967The U.S. Defense Science Board convenes a task force on computer security, the policy context for the early field Anderson later helped develop.
• 1972Authors the Computer Security Technology Planning Study for the U.S. Air Force, analyzing malicious threats, penetration, security kernels, and evaluation.
• 1980Publishes work on computer-security threat monitoring and surveillance for a U.S. government client.
• 2014Dies; Purdue's CERIAS records his passing as that of a computer-security pioneer.