Controversial cybersecurity plan gets legal review

American Bar Association’s Committee on Cyberspace Law look at ramifications of Jericho Forum ideas

The notion of removing the security perimeter around corporate information -- a concept known as deperimeterization -- expounded by the Jericho Forum has been a hot technology debate, but now what could be controversial legal aspects of it are being brought up as well.

The American Bar Association's Committee on Cyberspace Law published a white paper on legal aspects of deperimeterization security with the Jericho Forum's secretariat, the Open Group. In it, the legal experts who wrote the paper, titled "Information Security Strategy: A Framework for Information-Centric Security Governance," say protecting critical data may entail businesses demanding greater ability to monitor each other's content security practices.

The Jericho Forum, a group of about 45 corporations worldwide, argues that traditional perimeter-based security that relies on firewalls or other physical network boundaries presents obstacles to e-commerce in an era dominated by mobile communications, outsourcing and the need to provide business partners with internal network access.

The Jericho Forum advocates finding options for securing critical information. In the 16-page white paper published yesterday by the ABA Committee on Cyberspace Law and the Open Group, the document's authors point to legal issues that arise when thinking about security compliance from the viewpoint of deperimeterization.

"Information security used to be about defining infrastructure (connectivity, storage and computing resource) policy to, in turn, define a closed perimeter by controlling who went across it (in and out) and what they could do with the resources (information access)," the three authors of the white paper write. They are Mike Jerbic, a consultant who chairs the Open Group Security forum and is a member of the American Bar Association's Business Law Section; Richard Keck, a legal expert with experience in telecommunications and e-commerce issues; and David Sartola, senior counsel in the finance, private-sector development and infrastructure unit of the World Bank legal department.

But they argue that in today's computing environment where resources are no longer scarce, this basic model no longer defines information security as it once did.

"Perimeters still exist, but they traverse across traditional boundaries of enterprises and systems and assume shapes that many security architects are inexperienced with," they contend. "This new 'shapeless perimeter' reflects the loss of the traditional shape of enclosing an entity with traditional forms, such as the enterprise perimeter, or host platform system. Instead, this shapeless perimeter surrounds the information, from wherever it is to wherever it is going."

There's a "new paradigm - informationcentric security," they assert.

The focus should be over control of information, which they acknowledge is hard, especially outside of a perimeter and at a distance. But the white paper they've written goes on to propose a legal framework that calls for "legal agreements between information-sharing parties," "verifiable administrative, technical and physical-control practices," and "standards that set expectations for control."

For "controlling information within a virtual perimeter," as the authors of the white paper suggest, an increased dialogue with business people and information technology professionals is needed to determine security compliance. Corporate policies have to extend beyond the internal networks and business processes to encompass formal agreements on how information will be controlled in enterprises involved in handling it.

This not only suggests establishing service-level agreements on a regular basis with business partners about information control, but possibly a higher level of monitoring that before.

"Monitoring is a key piece of control, but there are few standards in this area," the white paper's authors argue. "It also is a politically charged issue -- what should you monitor? What records are appropriate to include here, bearing in mind privacy and related constraints?" The white paper advocates developing a standard for log interoperability and analysis, noting there's already an Open Group technical proposal in this realm as well as a developing standard for Risk Analysis and Risk management, based on a factor analysis.

The white paper can be found at the Open Group site.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Ellen Messmer

Network World
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Kurt Hegetschweiler

Brother PocketJet PJ-773 A4 Portable Thermal Printer

It’s perfect for mobile workers. Just take it out — it’s small enough to sit anywhere — turn it on, load a sheet of paper, and start printing.

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?