UPI Study › Courses › Ethics in Technology › Free lessons › Lesson 1.3 Free with a free account
How the Field of Protecting Digital Information Has Evolved Over the Decades
Ethics in Technology · Chapter 1: What Cybersecurity Means and Why Protecting Digital Information Is Everyone's ResponsibilitySection 1.3 · lesson 3 of 11614 min · free with a free account
Free preview
Create a free account to keep watching
It takes a minute and costs nothing. Your free account unlocks all of Chapter 1 and 3 more lessons of Ethics in Technology.
Lesson complete
Earn the 3 college credits for Ethics in Technology
Enrolling adds a quiz after each lesson, the graded work and the official transcript. Recommended for credit by NCCRS.
Next lesson: Why Failing to Protect Information Can Cost Organizations Money, Trust, and Reputation →← The Core Ideas Behind Keeping Information Safe from Unauthorized AccessNext lesson: Why Failing to Protect Information Can Cost Organizations Money, Trust, and Reputation →
In this lesson
New conveniences added new routes to information.
- Trace 5 overlapping eras
- Explain why old responsibilities persist
- Describe CERT/CC and coordinated disclosure
- Connect standards and specialist careers to changing needs
Free study notes
Get this lesson's notes by email
The key points and 4 practice questions with answers, in your inbox. One email, free.
One email. Unsubscribe in one click.
Transcript
Everything said in the video, section by section (1,689 words). Read along, or search it.
Chapter 1
How Digital Protection Evolved
Digital protection did not arrive as one complete design, agreed before people began using computers. It grew through responses to new conveniences, and to the trouble those conveniences made possible. Sharing a machine, sending information, selling online, and outsourcing infrastructure each opened a new route. This lesson follows five broad eras, whose dates are approximate and whose practices overlap. Organizations move at different speeds, so one workplace can operate across several eras at once. The central pattern is accumulation: new controls add responsibilities, while older responsibilities remain. We also examine why the CERT Coordination Center made coordinated response a lasting habit. Standards bodies supply shared descriptions of practice, allowing organizations and auditors to compare expectations. Finally, we trace how protection grew from a side duty, into a profession with distinct specialties. History makes today's controls easier to understand, because each answers a problem with a recognizable cause.
Mainframe Era
Control the Room, Control the Machine
In the nineteen sixties and early nineteen seventies, a mainframe was effectively a room-sized computer. Banks, universities, and government agencies placed it in a controlled space, shared by many users. People brought punched cards, or worked through terminals wired directly to the machine. Information remained on nearby tapes and disk packs, instead of traveling across an open network. Physical access therefore dominated the protective problem: who could reach the machine and its media? Locks, guards, badges, sign-in sheets, and tape-removal rules provided practical answers. Facilities staff and operations managers handled much of this responsibility, alongside their other duties. Fire, flood, theft, and a disgruntled person with tape-library access were important concerns. Two lasting ideas emerged: restrict access to genuine needs, and reconstruct what happened through records. Later systems translated those ideas into least privilege and logs, without eliminating the physical controls.
Networked Era
Connectivity Turns Local Problems Into Shared Ones
From the mid-nineteen seventies onward, machines increasingly exchanged information over network connections. Research networks linked institutions, while businesses connected branch offices through leased lines. By the nineteen eighties, a desktop computer could reach a shared server down the hall. Information now moved without someone physically carrying a tape through a controlled doorway. A locked room remained useful, but it could not govern every signal arriving along a wire. Passwords became necessary access checks, while access control lists connected accounts to particular files. Encrypting information in transit also became commercially relevant, beyond earlier military uses. Self-spreading programs showed how software could move between connected machines, sometimes experimentally and sometimes destructively. Connectivity changed a local problem into a shared concern, spreading at the speed of the network. The lesson persists: connected systems inherit concerns that physical isolation once helped contain.
Internet and Commerce
Strangers Can Reach Valuable Systems
The public internet changed who could reach organizational systems, especially during the nineteen nineties. Earlier networks often connected institutions with existing relationships; public connectivity admitted unfamiliar outsiders. Online catalogs, payment forms, and banking portals increased the value reachable through those connections. An unknown person far away could now contact a system holding customer and payment information. Firewalls matured as boundaries between internal networks and the world outside them. Encrypted web traffic became expected, while intrusion detection watched for suspicious patterns. Antivirus software also became a familiar organizational purchase, rather than a narrow specialist tool. The same convenience enabling remote customers also created routes for remote attackers. Widely used software introduced another shared problem: one flaw could affect many organizations at once. No single organization could warn and coordinate every affected administrator through its own informal contacts.
Coordinated Response
CERT/CC Addressed an Organizational Failure
In November nineteen eighty-eight, a self-replicating program slowed or disabled many research-internet machines. The disruption exposed more than a technical weakness: administrators lacked a known coordination point. Nobody had a central destination for reports, or one dependable source of instructions for responding. The Defense Advanced Research Projects Agency supported a center at Carnegie Mellon University's Software Engineering Institute. That center became the CERT Coordination Center, commonly shortened to CERT C C. Its role included receiving reports, verifying problems, coordinating with vendors, and publishing actionable advisories. Coordinated disclosure gives the party able to fix a flaw an opportunity to respond before public announcement. The eventual advisory should be specific enough for affected organizations to take useful action. National and sector response teams, and vendor disclosure programs, carry related coordination practices forward. The enduring contribution is the workflow: reliable reporting, a coordinated remedy, and shared public guidance.
Compliance Era
Protection Must Be Demonstrable
From roughly the late nineteen nineties into the two thousands, protection increasingly acquired formal obligations. Voluntary effort produced uneven results, especially when customers bore much of the harm from failures. Sensitive health, financial, student, and payment information attracted government or industry requirements. Protection needed to be demonstrated, rather than merely asserted by the organization handling the records. Written policies described expectations, while records showed whether people followed those policies. Testing evidence and audits made the controls open to examination against a shared yardstick. Published standards supplied a vocabulary for describing what good practice should look like. But compliance and security are related ideas, rather than identical outcomes. A policy can be filed correctly, while an annual test misses problems on a system changing weekly. Practitioners must therefore consider daily safety, alongside the evidence that satisfies an audit.
Shared Yardsticks
Standards Bodies Make Practice Comparable
Different standards bodies contribute different parts of the shared security vocabulary. The International Organization for Standardization, and the International Electrotechnical Commission, publish consensus standards. Their twenty-seven-thousand family describes information-security management, and provides a basis for certification. The National Institute of Standards and Technology is a United States federal standards agency. Its freely available Cybersecurity Framework and special-publication eight-hundred series are used beyond the United States. The Internet Engineering Task Force develops internet protocol specifications, published through Requests for Comments. The Payment Card Industry Security Standards Council provides the Data Security Standard for payment-card information. That is an industry standard, illustrating how card-industry rules shape protection of relevant data. CERT C C and national response teams provide advisories, disclosure coordination, and incident-handling guidance. The common purpose is comparability, while each organization addresses a different aspect of protective practice.
Cloud and Mobile
Identity Becomes a Working Boundary
From roughly twenty ten onward, cloud services and mobile work weakened the familiar inside-outside boundary. Organizations placed information on infrastructure operated by someone else, rather than entirely within their buildings. People worked from personal devices, in homes, airports, and cafes beyond the office network. Software also incorporated many third-party components, adding dependencies across a wider supply chain. A single network perimeter could not describe where all the important information and users actually were. Protective attention therefore shifted toward the identity and conditions behind each request. Ask who is requesting access, on which device, and in what condition. Also ask which resource is requested, and whether the request fits the person's normal activity. The idea is continued verification, rather than permanent trust granted by a network location. Providers and customers share responsibilities, requiring protection to follow information beyond the office wall.
Artificial Intelligence
Both the Defenses and the Targets Change
Artificial intelligence now affects defenders, attackers, and the systems that need protection. Defenders use it to analyze large volumes of records, finding patterns difficult to notice in time. That capability helps direct attention, when activity exceeds what individual people can review manually. Attackers can use similar automation to produce convincing messages, or probe systems more quickly. Audio and video impersonations also make apparently familiar voices or faces less dependable as proof. The source connects that deception with attempts to authorize payments through convincing impersonation. Organizations must consider the reliability of the request, rather than only its convincing presentation. Models themselves become valuable systems, especially when an organization depends on their decisions. The training data and the instructions steering those systems therefore need protection too. This adds another responsibility, while the physical, network, application, and operational responsibilities continue.
Accumulating Responsibilities
The New Layer Does Not Retire the Old One
The five eras summarize a repeated relationship between convenience, exposure, and response. The mainframe concentrated shared processing, making physical access and insider misuse central concerns. Networking made information travel, introducing remote access and self-spreading software as broader problems. Public internet commerce admitted strangers, making boundaries, encrypted traffic, and monitoring increasingly important. Large regulated data stores prompted documented controls, audits, and obligations to demonstrate protection. Cloud, mobile, and artificial intelligence broadened dependencies, emphasizing identity, ongoing monitoring, and provider responsibilities. None of these developments made locked doors, access lists, or firewalls irrelevant. Data centers still need physical controls, and organizations still need to meet their compliance obligations. A hospital can use decades-old equipment, while its billing department operates through much newer services. The eras overlap, and the accumulated responsibilities explain why the field requires teams with varied skills.
A Growing Profession
From Side Duty to Executive Accountability
Early protection was distributed among operators, facilities managers, and auditors, as part of other work. Network controls often fell to systems administrators, who were already responsible for keeping servers running. As exposure grew, protective work became too extensive and consequential to remain only a secondary duty. The internet era expanded dedicated practitioners, and commercial products aimed specifically at protection. The compliance era strengthened executive accountability, because regulators and boards needed someone answerable for risk decisions. The chief information security officer connects protection with senior decisions about authority and budgets. Professional credentials and academic programs created routes for newcomers, and ways for employers to assess candidates. Further specialization followed, because the required skills diverged rather than remaining one general technical task. Writing policy, investigating alerts, reviewing software, and designing usable training require different kinds of expertise. The professional structure reflects the breadth of the problems, rather than simply new job titles.
Different Skills
Specialties Reflect Different Problems
Security operations and incident response monitor activity, investigate alerts, contain harm, and support recovery. Governance, risk, and compliance translate obligations into policies, controls, and preparation for audits. Application and product security review code and design, test releases, and manage component-related weaknesses. Identity and access management decide who may reach resources, under which device and request conditions. Authorized offensive testing looks for weaknesses through attempts made with permission, before others exploit them. Awareness and human-factor work develop training and processes that people can realistically follow. Operations grew with connectivity, while governance grew with formal obligations and executive accountability. Application work grew with internet services, and continuous identity checks became central with cloud and mobile use. Human behavior mattered in every era, with impersonation adding new pressure to an enduring concern. Remember the pattern: convenience creates a route, protection responds, and the next era adds another responsibility.
About Ethics in Technology at UPI Study
Ethics in Technology (Computer Science 195) is a self-paced online course of 116 video lessons in 15 chapters, from cybersecurity basics, privacy and surveillance to big data, hacking, malware, network defense, intellectual property, cybercrime, encryption, emerging technology and digital citizenship. It carries a NCCRS credit recommendation for 3 semester credits.
Every lesson transcript is free on pages like this one, and the videos are free with a free UPI Study account. Enrolling adds a practice quiz after each lesson, the graded work and final exam that earn the credit, lifetime access, and an official transcript on completion. UPI Study has helped over 130,000 students with college credits. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
Enroll now → Course details Download the syllabus All Computer Science courses
Compare: Cybersecurity vs Ethics in Technology · Which ethics course?
Why take it here
Why students take Ethics in Technology with UPI Study
Where the credit goes
Universities that work with NCCRS
Ethics in Technology carries a NCCRS credit recommendation. These universities work with NCCRS; some are UPI Study's signed partners. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
Thomas Edison State UniversitySigned partner
University of the PeopleSigned partner
Charter Oak State CollegeSigned partner
Strayer UniversitySigned partner
Columbia Southern UniversitySigned partner
Indiana TechSigned partner
Penn StateWorks with NCCRS
Southern New Hampshire UniversityWorks with NCCRS
SUNYWorks with NCCRS
+many more cooperating universitiesFind my college →Find my college → Not listed? Ask Athena in the corner of this page, or book a 15-minute call.
FAQ
Questions students ask us
About How the Field of Protecting Digital Information Has Evolved Over the Decades
How has cybersecurity changed over the decades?
What was the Morris worm and why did it lead to CERT?
What is coordinated vulnerability disclosure?
Which organizations publish the main cybersecurity standards?
About the Ethics in Technology course
How many college credits is Ethics in Technology?
How much does Ethics in Technology cost and what is included?
Which universities accept UPI Study credits?
How long does Ethics in Technology take?
How are the exams done?
How do my credits reach my college?
Ready for the full course? Earn 3 credits in Ethics in Technology.
116 video lessons, a quiz after each one, and the graded work that earns the credit. Recommended for credit by NCCRS.
3 credits · NCCRSEnroll →