Controversial cybersecurity plan gets legal review

The notion of removing the security perimeter around corporate information – a concept known as deperimeterization – expounded by the Jericho Forum has been a hot technology debate, but now what could be controversial legal aspects of it are being brought up as well.

The American Bar Association’s Committee on Cyberspace Law yesterday published a white paper on legal aspects of deperimeterization security with the Jericho Forum’s secretariat, the Open Group. In it, the legal experts who wrote the paper, titled “Information Security Strategy: A Framework for Information-Centric Security Governance,” say protecting critical data may entail businesses demanding greater ability to monitor each other’s content security practices.

The Jericho Forum, a group of about 45 corporations worldwide, argues that traditional perimeter-based security that relies on firewalls or other physical network boundaries presents obstacles to e-commerce in an era dominated by mobile communications, outsourcing and the need to provide business partners with internal network access.

The Jericho Forum advocates finding options for securing critical information. In the 16-page white paper published yesterday by the ABA Committee on Cyberspace Law and the Open Group Security Forum, the document’s authors point to legal issues that arise when thinking about security compliance from the viewpoint of deperimeterization.

“Information security used to be about defining infrastructure (connectivity, storage and computing resource) policy to, in turn, define a closed perimeter by controlling who went across it (in and out) and what they could do with the resources (information access),” the three authors of the white paper write. They are Mike Jerbic, a consultant who chairs the Open Group Security forum and is a member of the American Bar Association’s Business Law Section; Richard Keck, a legal expert with experience in telecommunications and e-commerce issues; and David Sartola, senior counsel in the finance, private-sector development and infrastructure unit of the World Bank legal department.

But they argue that in today’s computing environment where resources are no longer scarce, this basic model no longer defines information security as it once did.