Ethics
Learning outcomes:
- Explain the concepts of trust and trustworthiness
- Describe important ethical issues in computer security
- Explain ethical issues in bug handling, bug disclosure, breach disclosure, and data exfiltration
- Describe compliance requirements for state and federal data handling
Would you like to download my PowerPoint to follow along?
- Trust
- Confidence placed in a person by making that person the nominal owner of property to be held or used for the benefit of one or more others.
- Transitive trust
- Web Certificates
- Digital signatures
- Ethics (With examples)
- Moral principles that govern a person's behavior or the conducting of an activity.
- Example: In the course of your job, you find confidential mental health information about someone who babysits your child. What do you do?
- Example: A client asks for a meeting at 3pm on a Friday, near your house. If the meeting ends early, do you go home or back to work?
- Example: You're getting all the credit for a team project at work or school. Do you say anything?
- Example: You work in IT and happen to see your coworkers' emails. Or, you're asked to go through the emails or computers of your coworkers or bosses.
- Real life example: Schools putting loggers and RATs on loaned laptops. There are multiple examples and articles talking about this
- Hackers
- Types of hackers
- White Hat
- Grey Hat
- Black Hat
- Hacktivists
- Ethics in Computer Security Example: Well known People
- Ethics in Computer Security: Hacker groups and Hacktivists
- Ethics: How to handle Bugs
- Patch times
- Bug prioritization
- Patch cycle
- How to do bug disclosure
- Responsible disclosure: Allows stakeholders time to fix bugs
- Full disclosure: Tells the public everything
- OWASP Vulnerability Disclosure Cheat Sheet
- Ethics: How to do Breach Disclosure
- Current Best Practices for Breach Disclosure
- Examples of Breaches and disclosures in real life
- Ethics: Data Exfiltration
- Steganography
- iPods (podsnarfing)
- Cameras
- USB drives (thumbsucking)
- Bluetooth (bluesnarfing)
- Sneakernet
- Compliance
- Certification or confirmation that the doer of an action (such as the writer of an audit report), or the manufacturer or supplier of a product, meets the requirements of accepted practices, legislation, prescribed rules and regulations, specified standards, or the terms of a contract.
- Federal Data Handling
- HIPAA
- FERPA
- Sarbanes Oxley (SOX)
- PCI-DSS (payment cards)
- International Bonus: GDPR
Suggested Activities and Discussion Topics:
- Write a paper following the instructions on this PDF (accessible HTML version)
- The following are some discussion topic ideas on ethics:
- Is it ever OK to pirate content, such as movies, games, or software? Does it matter if the content is no longer available, not available where you live, or priced so only a large corporation can afford it?
- Is information on a company device private? What about accounts logged in on that device? What if your job requires a phone, but the company won't pay for one? What if they pay for one, but you can't afford a second phone of your own?
- When should your data belong to you? What if it was collected in a way you couldn't do on your own, such as medical imaging or other expensive equipment?
- Should companies be able to see your credit score? Should they be able to ask for your social media logins? Does your answer change for different jobs or companies, such as government jobs, contractors, or jobs that affect everyone in society, like teachers, police officers, or social workers?
Would you like to see some more classes? View all classes