Prolog

In 1975, the illustrious Dorothy Denning received her Ph.D. from Purdue’s CS Department. Thereafter, she became an assistant professor, and then associate professor in 1981. Her most notable advisee was Matt Bishop, who graduated with his Ph.D. in 1984.

Dorothy initiated a graduate class in cryptography, CS 555, using her book Cryptography and Data Security, around 1980. That class is still taught today (with regular updates), perhaps making it the longest-running cybersecurity class in academia.

In 1983, Sam Wagstaff, Jr. (now a professor emeritus) joined the Purdue CS faculty as an expert in cryptography and algorithms. In 1988, Eugene Spafford joined the Purdue CS faculty with expertise in software engineering and distributed systems; Spaf also had a long-standing interest in information security, but not as an academic concentration. (Both Sam and Spaf have taught CS 555 over the years.)

Most of the academic research around the world in the 1970s and 1980s into what later became known as “cybersecurity” was focused on formal methods, authentication models, and cryptography. Some security research was secondary to OS security, database, and architecture, but it was not a particularly distinct topic area in classes or academic research. There were only 2 or 3 universities with any identifiable expertise in the overall topic area, outside of cryptography and formal methods of software development.

COAST

The Cuckoo’s Egg incident in 1986, and the Internet Worm in 1988 helped generate a great deal of interest in more applied security. Spaf had involvement in both, and especially notable in the Worm incident. Subsequent growth of instances of hacking and malware brought increased interest including some funding for research.

Early Purdue successes included release of COPS (developed by Dan Farmer under Spaf’s direction), and the publication of Practical Unix Security, co-authored by Spaf and Simson Garfinkel. Both brought attention to Purdue.

Increased student interest in computing security coursework and external funding from companies and government agencies led to Spaf and Sam establishing the COAST Laboratory within the CS department in the fall semester of 1991. The CS department provided a room for the lab and student office spaces. Four companies made generous donations to equip the lab initially: Sun Microsystems, Bell Northern Research, Schlumberger, and Hughes Laboratories.

The name COAST was suggested by Steve Chapin, one of Spaf’s Ph.D. students. It is an acronym for “Computer Operations, Audit, and Security Tools,” reflecting the more applied focus of the group. Steve was the first Ph.D. graduate from the lab, in 1993.

In the next few years, COAST became notable for a number of innovative and groundbreaking projects, including the Tripwire tool, the IDIOT intrusion detection system by Kumar, vulnerability classification work by Aslam and Krsul, the first-ever papers describing software forensics by (individually and as a group) Krsul, Spafford, and Weeber, discovery of the lurking Kerberos 4 encryption flaw by Dole and Lodin, the firewall reference model by Schuba, and the first online (ftp, gopher, and www) repository of cybersecurity tools; a remnant of that repository with many historical artifacts is available online. Many other people also contributed to notable successes, some of whom are noted below.

In 1992, COAST began to host a regular seminar series of local and invited speakers. That seminar series continues to this day; there is an archive of talk descriptions (from 1994 onwards) and videos (from late 1999 onwards). The series has featured a veritable “Who’s Who” of people in cybersecurity research, industry, and government. The series continues to attract viewers worldwide, and the entire collection is available for free viewing.

Despite the growing interest, in 1997, when Spaf testified before the House Science Committee, there were only three identified academic centers other than at Purdue. Shortly thereafter, continued growth and faculty involvement led to the transformation of COAST into the campus-wide institute CERIAS, in May of 1998. That will be the topic of a later post.

As of now, however, congrats to all the people who contributed to the founding and growth of COAST – celebrating its 30th anniversary this academic year!

Where are they now?

A number of students completed their degrees and worked in COAST, most under the direction of Professor Spafford. Here are a few of them:

• Steve J. Chapin; PhD; Lead Cyber Security Researcher, Lawrence Livermore National Laboratories.
• Sandeep Kumar; PhD; Staff Engineer, VMware, CA.
• Christoph Schuba; PhD; Senior Security Architect, Apple Computer.
• Ivan Krsul; PhD; President, Arte Xacta (La Paz, Bolivia).
• Sofie Nystrom; MS; Director General at Norwegian National Security Authority.
• Saumil Shah; MS; CEO and Founder, Net Square.
• Aurobindo Sundaram; MS; Head of Information Assurance & Data Protection at RELX.
• Taimu Aslam; MS; CTO at Broadstone Technologies.
• Steve Weeber; MS; IP Architect at Windstream Communications.
• Bryn Dole; MS; Self-employed, and co-founder of both Topix and Blekko.
• Steve Lodin; MS; Senior Director, IAM and Cybersecurity Operations at Sallie Mae.
• Mark Crosbie; MS; Dropbox Data Protection Officer.
• Jai Balasubramaniyan; MS; ColorTokens, Inc. Director of Product Management.
• Katherine Schikore; MS; Software Developer SAS Institute.
• Gene Kim; BS; Author, Researcher, Speaker, and co-founder of Tripwire, Inc.
• Todd O'Boyle; BS; AWS Consultant.
• Keith Watson; BS; Director of Threat Management. Optiv, Inc.
• Lucas Nelson; BS; Partner at Lytical Ventures, LLC.
• Tanya Crosbie; BS; Owner, Giggles & Smiles Photgraphy.