Chapter 10 — Ethics and authorized practice

Lesson map

Lesson 10 published. Map, example, EX028.

flowchart TD
  N0["Learning outcomes"]
  N1["10.1 Ethical principles"]
  N2["10.2 Deception safeguards"]
  N3["10.3 Rules for simulations"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX028"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["10.1 Ethical principles"]
  N2["10.2 Deception safeguards"]
  N3["10.3 Rules for simulations"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX028"]

[Learning outcomes]
    |
    v
[10.1 Ethical principles]
    |
    v
[10.2 Deception safeguards]
    |
    v
[10.3 Rules for simulations]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX028]

Learning outcomes

You will (1) apply ethical principles to human factors research; (2) explain why deception requires special safeguards; (3) describe ethical rules for phishing simulations.

10.1 Ethical principles

Research with people must respect autonomy, avoid harm and treat people fairly. Nadia learns that her university requires ethics approval for any study involving staff, including surveys and interviews. Participants must know what the study involves, agree freely and be able to withdraw. Data must be protected and results reported without identifying individuals. These principles apply even to small student projects, because a careless question or a leaked comment can harm someone's job or relationships with colleagues. She completes the ethics module before any fieldwork begins.

10.2 Deception safeguards

Some security exercises involve deception, such as simulated phishing emails. Deception conflicts with informed consent, so it needs strong justification and safeguards. Nadia learns that ethics committees usually require that the deception is necessary, that harm is minimal, that participants are told afterwards and that they can withdraw their data. In organisations, staff representatives should agree the programme. She notes that deception can damage trust, which is itself a security asset, so it should be used sparingly and with care. She records this view.

10.3 Rules for simulations

Nadia drafts rules for any future simulation at Ashcombe: announce that a programme exists; agree templates with staff representatives; avoid lures exploiting personal distress, such as pay or health; give immediate, kind feedback; report only aggregate results; and never use results for discipline. Lain, Kostiainen and Čapkun (2022) found that some common practices, such as long training pages after a click, did not help. The rules aim to make simulations a learning tool that respects staff rather than a trap that undermines their trust.

Worked example

Nadia applies research ethics, explains deception safeguards and drafts six rules for ethical simulations.

Synthetic case. The rules are synthetic guidance; Lain et al. (2022) is real.

Errors and limits

Rules can be ignored under pressure. Representatives may not exist in small organisations.

Exercises

• EX028 — Participant rights. What must participants be able to do?
  Show marking criteria

  Rubric: 3 = know, agree freely and withdraw;; 2 = consent;; 1 = vague;; 0 = none.
• EX029 — Trust as asset. Why should deception be used sparingly?
  Show marking criteria

  Rubric: 3 = it can damage trust, which is a security asset;; 2 = trust;; 1 = vague;; 0 = none.
• EX030 — Banned lure type. Which lures do the rules ban?
  Show marking criteria

  Rubric: 3 = those exploiting personal distress such as pay or health;; 2 = distress;; 1 = vague;; 0 = none.

Synthesis

Ethical practice requires consent, safeguards for deception and respectful simulation rules.

Continue studying — chapter 10 of 40

← Chapter 09 (draft) · Course chapter index · Chapter 11 (draft) →