Controversial cybersecurity plan gets legal review

American Bar Association’s Committee on Cyberspace Law look at ramifications of Jericho Forum ideas

The notion of removing the security perimeter around corporate information -- a concept known as deperimeterization -- expounded by the Jericho Forum has been a hot technology debate, but now what could be controversial legal aspects of it are being brought up as well.

The American Bar Association's Committee on Cyberspace Law published a white paper on legal aspects of deperimeterization security with the Jericho Forum's secretariat, the Open Group. In it, the legal experts who wrote the paper, titled "Information Security Strategy: A Framework for Information-Centric Security Governance," say protecting critical data may entail businesses demanding greater ability to monitor each other's content security practices.

The Jericho Forum, a group of about 45 corporations worldwide, argues that traditional perimeter-based security that relies on firewalls or other physical network boundaries presents obstacles to e-commerce in an era dominated by mobile communications, outsourcing and the need to provide business partners with internal network access.

The Jericho Forum advocates finding options for securing critical information. In the 16-page white paper published yesterday by the ABA Committee on Cyberspace Law and the Open Group, the document's authors point to legal issues that arise when thinking about security compliance from the viewpoint of deperimeterization.

"Information security used to be about defining infrastructure (connectivity, storage and computing resource) policy to, in turn, define a closed perimeter by controlling who went across it (in and out) and what they could do with the resources (information access)," the three authors of the white paper write. They are Mike Jerbic, a consultant who chairs the Open Group Security forum and is a member of the American Bar Association's Business Law Section; Richard Keck, a legal expert with experience in telecommunications and e-commerce issues; and David Sartola, senior counsel in the finance, private-sector development and infrastructure unit of the World Bank legal department.

But they argue that in today's computing environment where resources are no longer scarce, this basic model no longer defines information security as it once did.

"Perimeters still exist, but they traverse across traditional boundaries of enterprises and systems and assume shapes that many security architects are inexperienced with," they contend. "This new 'shapeless perimeter' reflects the loss of the traditional shape of enclosing an entity with traditional forms, such as the enterprise perimeter, or host platform system. Instead, this shapeless perimeter surrounds the information, from wherever it is to wherever it is going."

There's a "new paradigm - informationcentric security," they assert.

The focus should be over control of information, which they acknowledge is hard, especially outside of a perimeter and at a distance. But the white paper they've written goes on to propose a legal framework that calls for "legal agreements between information-sharing parties," "verifiable administrative, technical and physical-control practices," and "standards that set expectations for control."

For "controlling information within a virtual perimeter," as the authors of the white paper suggest, an increased dialogue with business people and information technology professionals is needed to determine security compliance. Corporate policies have to extend beyond the internal networks and business processes to encompass formal agreements on how information will be controlled in enterprises involved in handling it.

This not only suggests establishing service-level agreements on a regular basis with business partners about information control, but possibly a higher level of monitoring that before.

"Monitoring is a key piece of control, but there are few standards in this area," the white paper's authors argue. "It also is a politically charged issue -- what should you monitor? What records are appropriate to include here, bearing in mind privacy and related constraints?" The white paper advocates developing a standard for log interoperability and analysis, noting there's already an Open Group technical proposal in this realm as well as a developing standard for Risk Analysis and Risk management, based on a factor analysis.

The white paper can be found at the Open Group site.

Join the newsletter!


Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Ellen Messmer

Network World
Show Comments

Brand Post

Most Popular Reviews

Latest Articles


PCW Evaluation Team

Luke Hill


I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Laura Johnston

MSI GS65 Stealth Thin

If you can afford the price tag, it is well worth the money. It out performs any other laptop I have tried for gaming, and the transportable design and incredible display also make it ideal for work.

Andrew Teoh

Brother MFC-L9570CDW Multifunction Printer

Touch screen visibility and operation was great and easy to navigate. Each menu and sub-menu was in an understandable order and category

Louise Coady

Brother MFC-L9570CDW Multifunction Printer

The printer was convenient, produced clear and vibrant images and was very easy to use

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?