Security began with doors and locks
For the first generation of computers, security meant physical security. A 1940s or 1950s machine filled a room, and the main protection was a locked door and a trusted staff. Anyone who could walk up to the console could, in principle, do anything. There were few users, programs ran one at a time, and data left the building on cards or tape, so the risks were mostly theft, sabotage or simple mistakes.
That picture changed once many people shared one machine. The problems of the time-sharing era, such as how to keep one user’s files away from another, are covered in the article on early security problems. In short, the 1960s introduced passwords, user accounts and permissions, and with them the first arguments about how well those protections actually held up.
The 1970s: turning a worry into a field
By the early 1970s, governments and large organizations were storing sensitive information on shared computers, and security became a subject of study. Reports commissioned by the United States military in that period, such as one by James P. Anderson in 1972, described the need for systems that enforce rules about who may read or change information. Researchers proposed formal models of access control, and a widely read 1975 paper by Jerome Saltzer and Michael Schroeder set out design principles, including giving each program only the privileges it needs and keeping designs simple enough to inspect.
Cryptography also moved out of the secret world. In 1976 Whitfield Diffie and Martin Hellman published the idea of public-key cryptography, in which two parties can establish secrets without first meeting. The RSA method followed in 1977. Around the same time, a national data encryption standard (DES) was adopted in the United States for protecting unclassified information. These tools later became the backbone of secure web traffic, banking and messaging.
The 1980s: small computers, new kinds of trouble
Personal computers brought machines into homes and small offices where nobody was managing security full time. The 1980s saw the first widely reported cases of self-spreading programs, including experimental viruses that traveled on floppy disks. The idea behind them is explained in the article on self-replicating programs, and the cautionary tale of early worms is told separately in the one on computer viruses.
The decade also brought hackers into public view, and with them new laws. In the United States, the Computer Fraud and Abuse Act became law in 1986, and other countries passed their own computer-crime statutes during the 1980s and 1990s. In 1988, a worm released by a graduate student spread across a large part of the then-small internet. One result was the creation of a coordination center at Carnegie Mellon University to help organizations respond to incidents. In the same decade, the U.S. Department of Defense published evaluation criteria for secure systems, popularly known as the Orange Book.
The 1990s: the network becomes the target
Once businesses and ordinary people began using the internet and the World Wide Web, the number of potential victims and attackers grew sharply. Firewalls, which filter traffic at the edge of a network, became standard. Antivirus software, which had begun in the late 1980s, grew into a mainstream product category. Netscape introduced SSL in the mid-1990s to protect data traveling between browsers and websites, and its successor, TLS, is still used today.
New attack styles also arrived. Email carried viruses and worms to millions of inboxes, sometimes by tricking recipients into opening an attachment. Web servers had flaws that let outsiders read or alter pages. Around the mid-1990s, the term phishing emerged for messages that imitate trusted senders in order to steal passwords. Many of these problems exploited people more than machines, a pattern that has continued ever since.
The 2000s and 2010s: crime, scale and awareness
As commerce moved online, attackers increasingly sought money. Networks of compromised machines, known as botnets, were used to send spam or to overwhelm websites with traffic. Stolen payment and personal data became valuable, and large data breaches made headlines. Security researchers and companies began paying rewards for responsibly reported flaws, and software makers adopted regular update schedules instead of occasional patches.
Smartphones, cloud services and the Internet of Things widened the surface to protect. Ransomware, which locks files until a payment is made, became a widespread problem in the 2010s. Governments also began treating cyberattacks as a national concern, and laws on privacy and breach reporting expanded, a story told in the article on the effect of computers on data protection.
What the history suggests
A few patterns repeat across the decades.
- Convenience and security often pull against each other. Every new way to share or connect adds a way to attack.
- Early designs tend to assume a trusting world. Protections are often added after trouble appears.
- Technology helps, but people matter. Weak passwords, unpatched software and convincing fake emails remain common routes in.
- Defenses work in layers. No single product, whether a password, encryption or a firewall, is enough alone.
Advice about specific products changes quickly, and no system can be called perfectly safe. What lasts from this history is the habit of assuming that mistakes will happen and designing so that one failure does not become a disaster.