The notion of removing the security perimeter around corporate information -- a concept known as deperimeterization -- expounded by the Jericho Forum has been a hot technology debate, but now what could be controversial legal aspects of it are being brought up as well.

The American Bar Association's Committee on Cyberspace Law published a white paper on legal aspects of deperimeterization security with the Jericho Forum's secretariat, the Open Group. In it, the legal experts who wrote the paper, titled "Information Security Strategy: A Framework for Information-Centric Security Governance," say protecting critical data may entail businesses demanding greater ability to monitor each other's content security practices.

The Jericho Forum, a group of about 45 corporations worldwide, argues that traditional perimeter-based security that relies on firewalls or other physical network boundaries presents obstacles to e-commerce in an era dominated by mobile communications, outsourcing and the need to provide business partners with internal network access.

The Jericho Forum advocates finding options for securing critical information. In the 16-page white paper published yesterday by the ABA Committee on Cyberspace Law and the Open Group, the document's authors point to legal issues that arise when thinking about security compliance from the viewpoint of deperimeterization.

"Information security used to be about defining infrastructure (connectivity, storage and computing resource) policy to, in turn, define a closed perimeter by controlling who went across it (in and out) and what they could do with the resources (information access)," the three authors of the white paper write. They are Mike Jerbic, a consultant who chairs the Open Group Security forum and is a member of the American Bar Association's Business Law Section; Richard Keck, a legal expert with experience in telecommunications and e-commerce issues; and David Sartola, senior counsel in the finance, private-sector development and infrastructure unit of the World Bank legal department.

But they argue that in today's computing environment where resources are no longer scarce, this basic model no longer defines information security as it once did.

"Perimeters still exist, but they traverse across traditional boundaries of enterprises and systems and assume shapes that many security architects are inexperienced with," they contend. "This new 'shapeless perimeter' reflects the loss of the traditional shape of enclosing an entity with traditional forms, such as the enterprise perimeter, or host platform system. Instead, this shapeless perimeter surrounds the information, from wherever it is to wherever it is going."

There's a "new paradigm - informationcentric security," they assert.

The focus should be over control of information, which they acknowledge is hard, especially outside of a perimeter and at a distance. But the white paper they've written goes on to propose a legal framework that calls for "legal agreements between information-sharing parties," "verifiable administrative, technical and physical-control practices," and "standards that set expectations for control."

For "controlling information within a virtual perimeter," as the authors of the white paper suggest, an increased dialogue with business people and information technology professionals is needed to determine security compliance. Corporate policies have to extend beyond the internal networks and business processes to encompass formal agreements on how information will be controlled in enterprises involved in handling it.

This not only suggests establishing service-level agreements on a regular basis with business partners about information control, but possibly a higher level of monitoring that before.

"Monitoring is a key piece of control, but there are few standards in this area," the white paper's authors argue. "It also is a politically charged issue -- what should you monitor? What records are appropriate to include here, bearing in mind privacy and related constraints?" The white paper advocates developing a standard for log interoperability and analysis, noting there's already an Open Group technical proposal in this realm as well as a developing standard for Risk Analysis and Risk management, based on a factor analysis.

The white paper can be found at the Open Group site.