Controversial cybersecurity plan gets legal review

American Bar Association’s Committee on Cyberspace Law look at ramifications of Jericho Forum ideas

The notion of removing the security perimeter around corporate information -- a concept known as deperimeterization -- expounded by the Jericho Forum has been a hot technology debate, but now what could be controversial legal aspects of it are being brought up as well.

The American Bar Association's Committee on Cyberspace Law published a white paper on legal aspects of deperimeterization security with the Jericho Forum's secretariat, the Open Group. In it, the legal experts who wrote the paper, titled "Information Security Strategy: A Framework for Information-Centric Security Governance," say protecting critical data may entail businesses demanding greater ability to monitor each other's content security practices.

The Jericho Forum, a group of about 45 corporations worldwide, argues that traditional perimeter-based security that relies on firewalls or other physical network boundaries presents obstacles to e-commerce in an era dominated by mobile communications, outsourcing and the need to provide business partners with internal network access.

The Jericho Forum advocates finding options for securing critical information. In the 16-page white paper published yesterday by the ABA Committee on Cyberspace Law and the Open Group, the document's authors point to legal issues that arise when thinking about security compliance from the viewpoint of deperimeterization.

"Information security used to be about defining infrastructure (connectivity, storage and computing resource) policy to, in turn, define a closed perimeter by controlling who went across it (in and out) and what they could do with the resources (information access)," the three authors of the white paper write. They are Mike Jerbic, a consultant who chairs the Open Group Security forum and is a member of the American Bar Association's Business Law Section; Richard Keck, a legal expert with experience in telecommunications and e-commerce issues; and David Sartola, senior counsel in the finance, private-sector development and infrastructure unit of the World Bank legal department.

But they argue that in today's computing environment where resources are no longer scarce, this basic model no longer defines information security as it once did.

"Perimeters still exist, but they traverse across traditional boundaries of enterprises and systems and assume shapes that many security architects are inexperienced with," they contend. "This new 'shapeless perimeter' reflects the loss of the traditional shape of enclosing an entity with traditional forms, such as the enterprise perimeter, or host platform system. Instead, this shapeless perimeter surrounds the information, from wherever it is to wherever it is going."

There's a "new paradigm - informationcentric security," they assert.

The focus should be over control of information, which they acknowledge is hard, especially outside of a perimeter and at a distance. But the white paper they've written goes on to propose a legal framework that calls for "legal agreements between information-sharing parties," "verifiable administrative, technical and physical-control practices," and "standards that set expectations for control."

For "controlling information within a virtual perimeter," as the authors of the white paper suggest, an increased dialogue with business people and information technology professionals is needed to determine security compliance. Corporate policies have to extend beyond the internal networks and business processes to encompass formal agreements on how information will be controlled in enterprises involved in handling it.

This not only suggests establishing service-level agreements on a regular basis with business partners about information control, but possibly a higher level of monitoring that before.

"Monitoring is a key piece of control, but there are few standards in this area," the white paper's authors argue. "It also is a politically charged issue -- what should you monitor? What records are appropriate to include here, bearing in mind privacy and related constraints?" The white paper advocates developing a standard for log interoperability and analysis, noting there's already an Open Group technical proposal in this realm as well as a developing standard for Risk Analysis and Risk management, based on a factor analysis.

The white paper can be found at the Open Group site.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Ellen Messmer

Network World

Comments

Comments are now closed.

Latest News Articles

Most Popular Articles

Follow Us

GGG Evaluation Team

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell

LIFEBOOK UH574

The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi

STYLISTIC Q702

The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott

STYLISTIC Q702

My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.

Resources

Best Deals on GoodGearGuide

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?