/find@mail

Articles, write-ups, and musings concerning the world of cybersecurity and technology.

Ethical Decision-Making Guide for Cybersecurity Professionals

Opinionated  · 2,573 words · 13 min read · by QiO:~$ ·

Ethical Decision-Making Guide for Cybersecurity Professionals

Compliance tells you what's allowed. Ethics asks what's right, and the gap between them is where security professionals do their hardest work.

I. Introduction

It is inevitable that cybersecurity professionals will encounter situations in the course of their duties that require ethical decision-making on a regular basis. Having a thoughtful and ethical approach to these situations is critical to maintaining professional standards, public trust and overall effectiveness. Such situations can be complex to navigate and present the individual with difficult decisions. Making such decisions in an ethical way is not always easy, nor are the choices always black-and-white. When personal and professional ethics break down in the cybersecurity field, the results can have serious legal and financial consequences, as well as a highly negative impact on customers and society.

In 2017, Equifax failed to patch a known vulnerability for over four months, even after being warned by DHS to apply the patch. The breach exposed data on roughly 148 million people. (The failure was as much one of process as of people. An internal scan missed the vulnerable system.) Similarly, in 2019, a former AWS engineer, Paige Thompson, exploited a misconfigured firewall to break into Capital One's cloud systems and steal personal information on more than 100 million people. The case is also a reminder that under the cloud's shared-responsibility model, customers have to secure their own configurations. In both cases, ethical failures punctuate the collapse of security. It is vital that corporations and cybersecurity professionals act with the highest ethical principles in mind, so that such failures are less likely to occur.

The following guide serves as an ethical decision-making structure for cybersecurity professionals and is intended to provide specific and actionable guidance to those employed in the field. The guide will outline such topics as legal frameworks, privacy, ethical hacking, investigations, and the ethical implications of AI and Big Data collection. This guide is also intended to bridge the gap between theoretical ideas and real-world application of ethics in cybersecurity by addressing specific ethical issues within several disciplines.

II. Introduction to Ethics in Cybersecurity

In general, the discussion of cybersecurity ethics revolves around three ethical theories: Utilitarianism, Deontology and Virtue Ethics. Utilitarianism focuses on actions that optimize the overall happiness of society or attempts to minimize harm. Deontology stresses adherence to rules, duties and principles over outcome, while virtue ethics are concerned with the personal values and virtues of the individual decision-maker. For a cybersecurity professional, it is important to understand these three principles and contemplate how they value each one, as well as how, in certain situations, they would apply them to their own decision-making process. Professional codes can help turn the theory into practice. The ISC2 Code of Ethics, for example, lists protecting society and the infrastructure first among its four canons. Undoubtedly, in the course of work, ethical decisions must be made, and professionals should understand the implications of their decisions as they relate to these frameworks. Understanding ethical motivations is a crucial part of maintaining ethical discipline. The individual and emotional element of ethical decision-making cannot be discounted. Each person is different, and motivations may vary, however the constant prevailing motivation which binds all cybersecurity professionals should be a sense of responsibility to protect from harm and to do good. Whatever the ethical theory a professional bases their decisions upon, it is important they do so with the end goal in mind of upholding professional and ethical principles.

As outlined in the introduction, catastrophic failures in security are often caused by ethical lapses in either individual or corporate collective ethics. In cybersecurity, the stakes could not be higher. Individuals tasked with protecting sensitive systems and information can easily cause the loss of organizational reputation, stakeholder trust, and risk the long-term success of their organizations. Such organizations and professionals have a duty to safeguard the public interest and act in a timely and competent manner to address threats and vulnerabilities. Additionally, organizational standards are important to maintain, because in many cases, outdated legal frameworks, and compliance are not sufficient to address the changing ethical landscape. This reality places more responsibility on individuals and collective organizations to operate ethically, absent appropriate legal frameworks.

In many cases, personal ethics may come into conflict with organizational goals, rules, procedures, directives, or pressures. Cybersecurity professionals may face ethical dilemmas when such conflicts occur. For example, an employee may be directed to monitor user activity within the company in a way that invades privacy but is aligned with corporate policy. Navigating such conflicts requires a professional to consider the ethical principles at play, such as respect for privacy or loyalty to their employer, while evaluating legal obligations concerning privacy and the potential for blowing the whistle if directives violate law or fundamental rights. Individuals in such situations face a difficult path and must employ ethical decision-making frameworks to weigh the consequences of resistance versus compliance. As discussed above, professionals who familiarize themselves with ethical frameworks are better equipped to make ethical decisions when faced with these types of conflicts. Deciding beforehand whether one's ethical boundaries lie in legal compliance or beyond, is crucial for cybersecurity professionals, as it is almost a certainty that these ethical conflicts will arise.

While there is an intersection of legal and ethical considerations in cybersecurity, it is important for professionals to distinguish between the two. Not all ethical failures are legal violations, but all legal violations are generally the result of ethical failures in decision-making. Additionally, it is important to remember that legal compliance ensures adherence to laws and regulations, but does not, in all cases, ensure ethical conduct on the part of individuals and organizations. The ethical cybersecurity practitioner will go beyond mere legal compliance when addressing the broader responsibility they are entrusted with.

Legal frameworks like HIPAA, GDPR, and the CCPA are intended to protect consumers and the public as a primary aim. They also provide a punitive framework for the justice system to prosecute misconduct and unethical corporate or individual behavior. Such frameworks are highly important in the landscape of corporate compliance. However, as discussed above, they are not intended to cover the depth and breadth of ethical responsibilities shared by organizations and cybersecurity professionals. That said, adherence to such standards is ethically important. Mishandling private medical information (HIPAA), or personal information (CCPA/GDPR) would not only be a violation of law in many circumstances but also unethical. Likewise, compliance with relevant NIST frameworks and ISO standards supports ethical behavior. It is important that cybersecurity professionals are familiar with all relevant legal and standard frameworks and develop a comprehensive understanding of each in order to maintain compliance and understand the bounds of its authority. This way, employees can clearly discern where the boundary between legal compliance and ethical standards exists.

With respect to ethical conflicts and conduct, professionals must always consider the intent and potential impact of their actions to ensure that decisions align with ethical principles like fairness, least-harm and respect for fundamental rights. It is important to maintain organizational transparency and document the decision-making process where feasible to increase accountability. When differences between legal, corporate and individual ethics appear, professionals should consider ethical frameworks and codes of conduct to resolve such conflicts. Bear in mind that the legal option is usually the most ethical course of action, but not always the easiest. Additionally, being proactive and engaging in ethical training and thought exercises can help professionals prepare for ethical challenges, draw distinctions between legal compliance and ethical responsibility, and address conflicts of interest with corporate policy and personal ethics.

IV. Privacy and Data Protection

In situations where organizations must collect data, it is important to balance the needs of the organization while protecting user privacy. The risks of inappropriate data usage, mishandling, over-collection and other unethical practices are high. According to the Federal Trade Commission, Cambridge Analytica harvested personal information from tens of millions of Facebook users for voter profiling and targeting, using a third-party app that also collected data from users' friends without their knowledge. (Facebook itself was not charged in that particular action.) Ethical data collection will place an emphasis on informed consent of users and transparency with stakeholders, as well as the ethical handling of sensitive data. Organizations would do well to over-disclose, rather than under-disclose when informing users of data collection. Hiding intended uses or the selling of customer and patient data is unethical. Individuals responsible for data collection should always weigh the ethical and potential legal implications of improper use, disclosure and mishandling of sensitive or personal data.

V. Ethical Hacking and Penetration Testing

Ethical hacking, or "white-hat-hacking" involves hacking as a service, to potentially uncover vulnerabilities in systems and software and report findings to a client. The lines between the "ethical" hacker and the unethical hacker lie in their ethics. Once ethical boundaries are crossed, one can do more harm than good. Professionals engaged in penetration testing must adhere to contracts, scope, and any other rules defined by legal frameworks, their organization, and their client.

Ethical hackers may uncover illegality or encounter sensitive material that is beyond the scope of their authority. Individuals in this field must take great care in such situations and consider the ethical implications of their actions. They must also learn to communicate vulnerabilities responsibly, and in a timely manner. For example, should a penetration tester discover a highly critical vulnerability early on in their testing engagement, it would be unethical not to inform either their employer or client immediately. Ethical hackers are equipped with the same knowledge that many of their adversarial counterparts possess, and thus, the temptation to use such knowledge for harm or personal gain can be tremendous. As noted in the introduction, an ethical hacker is bound by their personal sense of duty to guard the public good. Penetration testing firms should focus on ethical education, and employee empowerment to follow ethical principles, and work with employees and clients to develop clear situational standards of conduct. In the absence of such standards and legal frameworks, ethical hacking professionals should employ ethical decision-making based on the above frameworks with an aim to act legally, and with the goal of least-harm.

VI. Cyber Investigations

Cyber investigators and forensics professionals can also encounter ethical dilemmas. For example, the intersection of surveillance and privacy rights can come into play, and it is not unusual for forensics professionals to encounter morally and societally repugnant material. Employees in this field can also fall victim to the temptation to engage in abhorrent practices that violate privacy as well. In 2013, shortly after the Edward Snowden leaks, it came out that some NSA employees had used the agency's surveillance power to spy on love interests, a practice nicknamed LOVEINT, a play on SIGINT, meaning "Signals intelligence." It was not an official program, just a nickname for misconduct, and it was documented separately from the Snowden documents, in an NSA inspector general letter to Senator Grassley that described at least a dozen substantiated cases over roughly a decade. Several were referred to the Justice Department, but none resulted in criminal charges. Such violations of trust are incomprehensible. Individuals must ethically weigh the costs of aiding investigators in an ethical manner versus the harms of potentially allowing criminals to go free or operate unabated. They must also weigh the consequences of causing reputational damage to their institutions by acting unethically. Quite often, in this discipline where societal harm is so easily demonstrated by illegal activity, the temptation to resort to a Machiavellian ("ends justify the means") approach to ethical decisions can be overwhelming. However, such decisions can erode public confidence in investigations, and if rights violations are involved, can lead to cases against individuals being dismissed. It is not for the cyber investigator to determine innocence or guilt, a principle the ISFCE code of ethics states directly. Their responsibility is to follow applicable laws, standards and established practices and conduct any decision-making beyond these with the aim of maintaining investigational and evidentiary integrity, while preserving rights and liberties.

VII. Cybercrime, Big Data and AI Ethics

Cybercrime, Big Data and Artificial Intelligence represent nascent and emerging ethical challenges in the cybersecurity landscape. This area has introduced the risks of enhanced surveillance, data misuse, and algorithmic discrimination. In September 2024, the Dutch data protection authority fined Clearview AI €30.5 million for illegally harvesting billions of facial images from the internet for its massive facial recognition database. It was not the first regulator to penalize the company, and Clearview has been under ethical scrutiny for years, since a 2020 New York Times investigation exposed the scale of its photo collection. Professionals who design, program and collect data for these systems must ensure that legal frameworks and compliance are integrated at every level. Organizations must balance the drive to innovate and/or protect with maintaining accountability and ethical standards. It is also important to practice proper informed consent, and use disclosure as discussed in section IV. Improper data collection and use, as well as failure to seek consent are unethical. Additionally, using biased datasets and algorithms can result in flawed and harmfully biased results. Proper auditing of collection methods, programming and bias filtering of results should be undertaken. Employees engaged in data collection and AI-driven decision-making should always remember that ethical considerations are not the purview of AI and are the responsibility of its handlers.

VIII. Conclusion

If there is one thread through all of this, it's that the law sets the floor, not the ceiling, and as the cases above show, people and organizations sometimes fall below even that floor.

Cybersecurity professionals have a great responsibility. In today's landscape, they are tasked with incredible access and trusted with the security of highly sensitive systems and information. Although rules, standards and legal compliance can often steer the decision-making process, there are times when such guides are not sufficient for the totality of the circumstance, and the individual or organization must make ethical decisions to fill in the gaps. All professionals engaged in the field must collectively guard not only the institutions, systems and data under their watch, but also the reputation and integrity of the discipline. It is essential that those in the field understand and apply the legal responsibilities and relevant frameworks, engage in ethical training, maintain ethical discipline, and act according to the highest ethical standards. Ethical lapses not only endanger the individual and the integrity of systems and data, but also the discipline of cybersecurity as a whole. Therefore, cyber professionals must be engaged in ongoing ethical decision-making education to address emerging technology and dilemmas while learning to navigate them in effective ways and apply ethical decision-making throughout their work.

Sources

Read next

SolarWinds: When the Software Update Is the Attack