Vendor lineage
NBS / NIST - the measurement laboratory that tested the standards
Somebody has to decide whether two implementations of a specification actually interoperate, and it is not usually the people who wrote it.
The National Bureau of Standards, renamed the National Institute of Standards and Technology in 1988, is a measurement laboratory rather than a networking company - and it appears in this history because the OSI period made testing a central question. Conformance to a document and interoperation with another vendor's product are different properties, and the gap between them needed a referee nobody had a commercial interest in.
The National Bureau of Standards was established by the Organic Act of 3 March 1901 with a staff of twelve, as the federal government's first physical science laboratory. It was renamed the National Institute of Standards and Technology in 1988, and the earlier name is worth keeping in mind when reading anything from before then.
Its computer security work started earlier than most people assume and in an unglamorous place - passwords. It published guidance on using passwords to control access to computer resources in 1977 and the first Password Usage Standard in 1985, covering composition and lifetime, concepts still under argument four decades later. In 1979 it published one of the first formal risk analysis methodologies for data processing systems, which moved the field from a checklist of controls toward pricing exposure, and in 1981 a contingency planning guide.
The Computer Security Act of 1987 then made the arrangement statutory: standards for unclassified federal computer systems would be developed by a civilian standards body rather than by the intelligence community, along with mandatory security training for people operating those systems. That division of responsibility is the reason American security guidance is published openly and can be read, cited and adopted by anyone - including by organisations in other countries with no obligation to follow it.
It is the least visible institution in this catalogue and one of the most widely used. A great deal of what a security team does daily traces to a document from an agency founded to standardise weights and measures, and the pattern holds generally: the organisations that shape practice most durably are usually the ones publishing specifications rather than the ones selling products.
- National Institute of Standards and Technology - measurement standards laboratory of the United States
- NIST, From NBS to NIST: founded as the National Bureau of Standards in 1901, renamed Bureau of Standards in 1903, national restored in 1934, and renamed the National Institute of Standards and Technology in 1988
- Computer Security Act of 1987, effective 8 January 1988: an act to provide for a computer standards program within the National Bureau of Standards, for government-wide computer security, and for training in security matters of people who manage, operate and use federal computer systems
- GovFacts history of NIST: the Organic Act of 3 March 1901 established the bureau with a staff of twelve; it published guidance on passwords for controlling access to computer resources in 1977, the first Password Usage Standard in 1985, one of the first formal risk analysis methodologies for data processing systems in 1979, and a contingency planning guide in 1981