Chapter 10 — Ethics and authorized practice | Bachelor's Incident response and cyber resilience

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 10 published. Map, example, EX028.

flowchart TD
  N0["Learning outcomes and connection"]
  N1["10.1 Why ethics is an operational skill"]
  N2["10.2 Scope and authorization"]
  N3["10.3 Least intrusive effective method"]
  N4["10.4 Conflict of interest"]
  N5["10.7 Practical activity"]
  N6["Chapter synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
  N6 --> EX["Worked example"]
  EX --> Q["Exercise EX028"]

Logical drawing

flowchart LR
  N0["Learning outcomes and connection"]
  N1["10.1 Why ethics is an operational skill"]
  N2["10.2 Scope and authorization"]
  N3["10.3 Least intrusive effective method"]
  N4["10.4 Conflict of interest"]
  N5["10.7 Practical activity"]
  N6["Chapter synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX028"]

[Learning outcomes and connection]
    |
    v
[10.1 Why ethics is an operational skill]
    |
    v
[10.2 Scope and authorization]
    |
    v
[10.3 Least intrusive effective method]
    |
    v
[10.4 Conflict of interest]
    |
    v
[10.7 Practical activity]
    |
    v
[Chapter synthesis]
    |
    v
[Worked example] --> [Exercise EX028]

Learning outcomes and connection

You will be able to (1) define scope, consent and authorization for response work; (2) apply the principle of the least intrusive effective method; (3) recognize and declare conflicts of interest; and (4) document an escalation when a request exceeds scope. Chapter 5 introduced the boundary between access and authority; here you learn to reason about it under pressure. Chapter 14 adds privacy law and minimization, and Chapter 32 the legal and communications interfaces.

10.1 Why ethics is an operational skill

Incident responders often have broad technical access and work under time pressure. Those two facts make overreach easy and its consequences serious: evidence obtained without authority can be unusable, staff trust can collapse, and the responder can personally break the law. Research ethics in computing makes the same point. The Menlo Report (US Department of Homeland Security, 2012) adapted the Belmont Report's principles — respect for persons, beneficence, justice — to information and communication technology research and added respect for law and public interest. These principles are a useful frame for response practice too: respect the people whose data you touch, weigh harm against benefit, distribute burdens fairly and stay within law and mandate.

10.2 Scope and authorization

Scope lists the systems, data and actions approved for an engagement or incident. Authorization names who approved it and when. Good practice records both at intake (Chapter 14 of the technologist book develops intake forms). Scope can expand, but only by the same process: a request, a decision by someone with authority, and a record. Technical access — an administrator password, an EDR console — does not define scope.

In the rota investigation, Dana's approved scope names organizational email, file-share audit logs and managed devices. A personal phone is outside it, however quickly the manager wants an answer, until the incident lead and counsel approve an extension.

10.3 Least intrusive effective method

When two methods would answer the question, choose the one that collects less personal data, changes fewer systems and can be reversed. Example: to learn whether an account signed in from a laptop, query sign-in logs before imaging the laptop; to learn whether a file was sent externally, check gateway metadata before reading message bodies. "Effective" matters: a method too weak to answer the question is not ethical just because it is gentle; it wastes time while harm continues.

Write down which method you chose and which gentler one you rejected.

10.4 Conflict of interest

A conflict exists when a personal or organizational interest could bias judgement: investigating your own manager, your friend, a system you designed, or a vendor you selected. Declare conflicts early and ask for reassignment or independent review. The record of declaration protects both the investigation and you.

In the rota case, the manager who pointed at Sam had a prior dispute with him, which is why Dana records the suggestion as a hypothesis rather than a lead. The same discipline applies to the investigator: if Dana had worked closely with Sam or with the manager, she should say so before the first interview, not after a complaint.

10.5 Consent and its limits

Consent is meaningful when it is informed, specific and freely given. Employees may feel they cannot refuse an employer's request, so organizations usually rely on policy and legal basis rather than on consent alone. When you ask a person for access to a personal device, explain what will be examined, by whom, for how long, and what they may refuse; involve HR or legal staff as policy requires.

Record what the person agreed to, in their words if possible, and whether a witness was present. In the rota case, any examination of Sam's phone would be limited to named folders, and he could withdraw his agreement at any point.

10.6 Worked example (synthetic): the personal phone

Fictional. During an investigation of a leaked rota spreadsheet at Harbourline, a manager asks investigator Dana to "check Sam's personal phone; he probably sent it from there". The approved scope covers organizational email, file-share audit logs and managed devices.

Options: (a) Take the phone and examine it: outside scope, no legal basis, coercive. Rejected. (b) Check file-share audit logs for downloads of the rota and gateway logs for messages with the file attached: in scope, low intrusion. Chosen first. (c) If (b) shows Sam downloaded the file to a managed device synced with a personal phone, request a scope extension through the incident lead and legal counsel, and, if approved, ask Sam to consent to a limited, witnessed examination of named folders, with the right to decline.

Escalation record: request, requester, reason, options considered, decision, decider, time. Dana also notes that the manager's certainty about Sam is a hypothesis, not evidence, and that the manager may have a conflict (a prior dispute).

10.7 Practical activity

Write a one-page scope statement for a fictional phishing incident: systems, data types, permitted actions, prohibited actions, approvers and an expansion procedure.

Make each prohibited action concrete, for example "no access to personal devices or personal accounts" rather than "respect privacy". Name the approvers by role, such as the incident lead and the privacy officer, and state how quickly a scope request must be answered during an incident. Add a short log template for requests: who asked, what for, who decided and when. Then test the document against the rota case in this chapter: would it have told Dana clearly what to do when the manager asked about Sam's phone? If not, revise the wording until it would.

10.8 Common errors and limits

Using technical access as a substitute for authorization.
Collecting "everything just in case".
Accepting a stakeholder's suspicion of a named person as a premise.
Failing to record declined requests; the refusal is part of the record.
Ethics frameworks guide judgement; they do not replace legal advice, which must come from qualified counsel in the relevant jurisdiction.
Letting urgency justify skipping the scope request, when a short call to the incident lead would settle it.
Treating a person's agreement as valid when refusing would plausibly cost them their job.

Exercises — chapter 10

Attempt each exercise before opening the worked results. Every case, organization, person, address and number in an exercise is synthetic unless a cited public source is named.

EX028 — Escalation record. Steps: write the record for §10.6 using the seven fields listed. Rubric: 3 = all fields, neutral wording, conflict noted; 2 = missing decider or time; 1 = narrative only; 0 = none.

EX029 — Least intrusive method. Inputs: question: "did the receptionist account export the appointment list yesterday?" Options: image the receptionist's PC; query the application audit log; interview the receptionist; review CCTV. Steps: rank by intrusion and effectiveness and choose a sequence. Rubric: 3 = audit log first, interview with HR guidance if needed, PC imaging only if justified and authorized, CCTV generally disproportionate; reasons given; 2 = order right, reasons thin; 1 = imaging first; 0 = none.

EX030 — Conflict check. Inputs: you designed the booking system's access model; an incident suggests a design flaw. Steps: state the conflict and two safeguards. Rubric: 3 = declares interest in the design being sound, proposes independent reviewer of conclusions and documented evidence trail; 2 = one safeguard; 1 = denies conflict; 0 = none.

Chapter synthesis

Authority comes from scope and named approval, not from access. Prefer the least intrusive method that can actually answer the question, declare conflicts, and record every escalation — including the requests you declined.