This booklet has been prepared for an audience of executives and managers, other than computer and ADP managers, in organizations using computers to help them understand the necessity for computer security and the problems encountered in providing for it.

There are still many gaps in our knowledge. Much more work needs to be done before an organization will be able to implement security provisions which are specific and justifiable responses to defined threats. There are, however, measures which may be taken and this booklet provides a general discussion of those solutions which are available today.

A question and answer format was selected to organize the material in a manner which might logically represent a general approach to analyzing computer security problems. The material on this booklet was drawn from the report of a workshop of top technical experts on the field of computer security, held in December 1972.

The Institute for Computer Sciences and Technology at the National Bureau of Standards, U.S. Department of Commerce and the Association for Computing Machinery the nation's largest technical society for computer professionals have been jointly sponsoring a series of workshops and action conferences on national issues. These workshops were designed to bring together the best talents in the country in the respective areas to establish a consensus on 1) current state of the art. 2) additional action required, and 3) where the responsibility for such action lies. The workshop on computer security was the first in the series and did, indeed, establish a precedent of satisfying those goals.