The Bell-La Padula security model produced conceptual tools for the analysis and design of secure computer systems. Together with its sibling engineering initiatives, it identified and elucidated security principles that endure today. This paper reviews those security principles, first in their own time, and then in the context of today's computer and network environment.

The author examines the notion of modeling, first as it applies to physical sciences, and then with reference to computer security. He identifies two undesirable aspects of models in general, which he calls incompleteness and inapplicability. A model of security given by D.E. Bell and L.J. La Padula (1975) is examined in light of the criticism that a model is a definition of that which it models; the author suggests that the critic's definition of the terms 'model' and 'security' is too wide.>

The general problem of protection in a network, focusing on its modeling in a packet-switch context, is considered. A general network interpretation of a standard computer security model is applied to the next-generation packet switch. The situation requires modeling at both the network and individual packet switch levels of discourse, using different interpretations.>

It may be possible for a deaf person and a hearing person to converse over the telephone. The deaf user "speaks" by typing to a text-to-speech converter using a low-redundancy keyboard system. The hearing user speaks sentences one word at a time to a large-vocabulary, isolated-word-recognition system that displays a sentence lattice (a sequence of sets of likely matches for each word spoken). The deaf user then tries to find a sensible path through the sentence lattice. Successful implementation of such a system, under development at SRI International, requires adequate performance in text generation speed by deaf users, text-to-speech intelligibility, and word-at-a-time speaking by hearing users, as well as large-vocabulary speech recognition and disambiguation of sentence lattices by deaf users.

Eight years after the completion of the "Secure Computer Systems" series, basic questions about that work are being raised. Is the model useful? Is it overly restrictive? Are further modeling efforts necessary to address current problems? This paper addresses those questions in a personal view of the development and the utility of the "Secure Computer Systems" security model.