Honeywell

The timeline

1. 1974
   The tiger team report

   An Air Force team led by Paul Karger and Roger Schell attacked Multics and wrote up what they found. The individual flaws mattered less than the demonstration: they showed the protection mechanism could be subverted by malicious software placed inside it, rather than defeated from outside. Among the observations, in a few lines, was that a back door could be hidden in the binary of a compiler.

2. 1975
   Project Guardian

   A joint Honeywell, MIT and Air Force effort initiated by Schell to build a minimised, verifiable security kernel in response to his own report. The conclusion the work rested on was that restructuring around such a kernel was essential before any system could be exposed to determined professional attackers - which was written about timesharing and reads as a description of the internet.

3. 1985
   The first B2

   Multics became the first operating system certified at B2 under the Trusted Computer System Evaluation Criteria - twenty years after the project started, and about a decade after the report that said it was not secure enough.

Flagship products and solutions

• The Honeywell 6180The specific machine the security evaluations were run against, and the one whose hardware enforced the protection rings the software depended on. Security work of this kind is always about a particular processor, whatever the papers say afterwards.
• MulticsThe timesharing system inherited with the GE division, and the one piece of this company's computing history that is still argued about.
• The Access Isolation MechanismMandatory access controls shipped in every Multics rather than in a special military edition, because the Air Force wanted commercially available systems rather than government-only ones.

Key innovations

• Rings, which are still in the processor you are reading this onHardware-enforced protection rings came out of this work, and the vocabulary survives exactly: ring 0 for the kernel and ring 3 for user code are Multics terms describing a Multics idea, implemented in every x86 processor made since. Very little from 1970s operating system research is still present in silicon.
• Security you cannot buy the cheap version ofBecause the Air Force insisted on commercial off-the-shelf systems rather than a government special, the mandatory access controls shipped to every customer with everything defaulted to the lowest classification. That is an unusual procurement decision with a lasting consequence: the secure configuration was the ordinary product, not an upgrade.
• The compiler back door, ten years earlyThe idea that a compiler could be modified to insert a back door into everything it built appears in the 1974 report, a decade before it became famous as a lecture. That the observation was made during a government security evaluation of a commercial operating system, and then largely forgotten until somebody restated it memorably, is its own comment on how security knowledge propagates.
• The critic who wrote the standardSchell led the team that documented Multics' weaknesses, then directed the agency that produced the Orange Book - the criteria against which secure systems were evaluated for the next decade, and which reads throughout as though written by somebody who had spent years attacking a specific system. The evaluation became the standard because its author was given the chance to generalise it.

Main markets

Analyst standing

• There is no computing position left to assess. What survives is a body of published work: the protection ring paper, the Karger and Schell evaluation, the design principles that came out of the same group, and the criteria that followed from them.
• The record here is that a mainframe division sold off and forgotten is nonetheless load-bearing. The vocabulary of operating system protection, the practice of formally evaluating security claims, and the observation that trusted tools can betray you all trace back through this machine - and every one of them arrived because somebody was funded to attack it and write down what worked.