The Importance of Ethics in Cyber Security

The knee-jerk answer to a ransom demand is no. The harder question is what happens when no isn't free.

Ethics rule our everyday lives. From personal to professional decision-making, ethical considerations continually come into play. Most people try to behave in an ethical manner and make the best decision that will be beneficial to themselves and those around them. With respect to cyber security professionals, ethics are a major consideration, from both a personal aspect and from an organizational standpoint. Cyber security professionals are presented with ethical decisions daily and must be prepared to consider the implications of their actions and act according to proper ethical standards.

The Individual

As the famous line from the Spider-Man movies goes: "With great power comes great responsibility." This statement is embodied by the modern cybersecurity professional, who is often entrusted with the security of critical information, granted highly privileged access to sensitive systems and is charged with protecting such things with their knowledge and expertise. Inevitably, such great responsibilities carry the weight of ethical decision-making. Can an individual be trusted with such information? Are they able to act in a responsible manner? Are they prepared to speak up when their organization is endangering the security of information or engaged in wrongdoing? What code of ethics does an individual subscribe to? Are they inclined to make utilitarian decisions, thus considering what will have the greatest positive impact for the most people? Furthermore, does such an ethical standard comport with their company's goals, which may be more deontological, in that it feels more duty-bound to make decisions affecting shareholders than the general public?

Professional codes exist to answer some of these questions. The ISC2 Code of Ethics, which certified members must follow, has four canons: protect society and the infrastructure, act honorably and legally, provide diligent and competent service to employers and clients, and advance and protect the profession. Notice which one comes first. Society is listed ahead of the employer, which is exactly the tension in that last question.

The Organization

Beyond the individual, organizations must also make ethical decisions. Companies must set forth clear standards that treat the security of their customers with great care. How will they respond to a breach? How will they inform the public? Will they inform the public? Are they taking appropriate steps to secure sensitive information, and empower their cyber security professionals to protect their interests, and their customers' interests? Are employees empowered to address concerns within the company concerning ethical issues? These are just a few examples of ethical concerns that organizations must consider.

The Ransom Question

One very interesting area of cybersecurity ethics that I had not considered at such a great level before reading the material in this module concerns ransomware payments. It is a very deep topic. Personally, my own ethical considerations from a knee-jerk perspective would have been against paying ransom to hackers. However, such a thing is easy to say, and in practice, it may be an incredibly hard decision to make. Does paying a ransom encourage future ransomware attacks? Can your company ethically support potentially funding terrorism or despotic nation-states? Is the potential harm to your customers or the public potentially greater than the harm caused by paying a ransom? What if a situation arose where hackers threatened to release a trove of personally sensitive information if a ransom isn't paid? Such situations are the stuff of nightmares for cyber security professionals.

It isn't only an ethical question, either. Under the U.S. Treasury's updated 2021 OFAC advisory, a company that pays a ransom to a sanctioned party can face civil penalties even if it didn't know who it was paying. Payment isn't flatly prohibited, but OFAC strongly discourages it and says that reporting the attack to law enforcement and cooperating weighs in a company's favor. Guidance like this changes, so check the current version before relying on it.

Such a scenario as above almost certainly becomes a legal and ethical minefield that both corporations, institutions and the security professionals that guard them are required to navigate. Allan Liska, writing on ransomware.org, echoes the struggle faced when deciding whether to pay a hacker's ransom. The security person inside him wants to scream "No!", but he says the answer "is a little more complex than that." The default answer is still no, he writes, though extenuating circumstances can soften it. It is clear that being prepared to address tough circumstances with a clearly defined set of ethical principles to guide decisions is critical in the cyber security industry.

Takeaway

What ties these questions together is timing. Nobody works out their ethics in the middle of a ransom demand. The principles have to be decided beforehand, which is what codes, policies, and training are for.

There can be no question that ethical issues will arise in the course of duty for both cyber security practitioners and their employers. It is critical that both the individual and the collective organization maintain high ethical standards and weigh decisions carefully. When organizations and individuals prioritize ethical behavior and prepare themselves to take ethical action amidst challenging circumstances, they can maintain trust placed in them, and limit harm. It is no mystery that the technology industry is rapidly changing. In fact, it is in a constant state of change. With such change comes new advancements like Artificial Intelligence and Quantum Computing. How will these things challenge the ethics of cyber security? Will the great power of A.I. and Quantum Computing be treated ethically and with a sense of great responsibility by those who wield them?

Sources

• Liska, Allan. "Should We Pay The Ransom - The Most Common Ransomware Question". ransomware.org.
• Infosec Institute. The ISC2 Code of Ethics: A Binding Requirement for Certification.
• Morgan Lewis. October 2021. OFAC Issues Updated Advisory on Sanctions Risks for Facilitating Ransomware Payments. Morgan Lewis.