Chapter 10 — Ethics and security | Bachelor's Information security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 10 — Ethics and security

Lesson map

Lesson 10 published. Map, example, EX028.

flowchart TD
  N0["Learning outcomes"]
  N1["10.1 Ethical reasoning"]
  N2["10.2 Monitoring and privacy"]
  N3["10.3 Discovered weaknesses"]
  N4["10.4 Fairness"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX028"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["10.1 Ethical reasoning"]
  N2["10.2 Monitoring and privacy"]
  N3["10.3 Discovered weaknesses"]
  N4["10.4 Fairness"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX028"]

[Learning outcomes]
    |
    v
[10.1 Ethical reasoning]
    |
    v
[10.2 Monitoring and privacy]
    |
    v
[10.3 Discovered weaknesses]
    |
    v
[10.4 Fairness]
    |
    v
[Worked example] --> [Exercise EX028]

Learning outcomes

You will (1) apply ethical reasoning to security decisions; (2) balance monitoring and privacy; (3) handle discovered weaknesses responsibly.

10.1 Ethical reasoning

Security professionals often have access to sensitive information and powerful tools. Aisha discusses cases where staff misused access, such as reading a neighbour's records out of curiosity. Dr. Carrow explains that professional ethics requires using access only for authorised purposes, being honest about risks and respecting people affected by security decisions. Aisha notes that legal and ethical are not identical, and that some legal actions are still wrong. The class discusses a case in which an employee looked up a celebrity's account and was dismissed.

10.2 Monitoring and privacy

Ashfield monitors staff email for signs of fraud. Aisha considers how far monitoring should go. Monitoring protects members, but excessive monitoring treats staff as suspects and may intrude on private messages. She suggests clear notices, limiting monitoring to work systems, restricting who can view results and reviewing whether it remains necessary. She learns that proportionality is the key ethical test for monitoring. Ashfield's monitoring notice is reviewed by the compliance officer, who adds a sentence explaining that personal messages are not read unless fraud is suspected and approved by two managers.

10.3 Discovered weaknesses

During a class exercise using a public website, a classmate notices a weakness on a real organisation's site. Aisha's group discusses what to do. They agree not to explore further and to report it through the organisation's published contact for security issues, if one exists. Dr. Carrow explains coordinated disclosure: telling the organisation privately and giving time to fix before any public discussion. The group records what they saw, informs Dr. Carrow and drafts a short message to the organisation, which Dr. Carrow reviews before it is sent through the official channel.

10.4 Fairness

Security decisions affect people unequally. A rule blocking logins from abroad may stop fraud but also blocks members travelling or living overseas. Aisha suggests letting members register travel and offering alternative verification. She learns that fair security considers who bears the burden of controls, and that the people most affected should have a way to raise problems and be heard. Ashfield adopts the travel registration option, and member complaints about blocked logins fall over the next quarter. Aisha notes that the change also improved fraud detection, because unexpected foreign logins now stand out more clearly.

Worked example

Aisha separates legal from ethical, applies proportionality to staff monitoring, follows coordinated disclosure for a found weakness and considers fairness of geographic login blocks.

Synthetic case. Cases are synthetic.

Errors and limits

Using authorised access for personal curiosity is a breach of trust.

Exercises

EX028 — Monitoring test. What is the key ethical test for monitoring? Rubric: 3 = proportionality;; 2 = partly correct;; 1 = other;; 0 = none.
EX029 — Disclosure approach. How should the found weakness be handled? Rubric: 3 = report privately via published contact;; 2 = partly correct;; 1 = vague;; 0 = none.
EX030 — Blocked group. Who is unfairly affected by foreign login blocks? Rubric: 3 = members abroad;; 2 = partly correct;; 1 = vague;; 0 = none.

Continue studying — lesson 10 (chapter 10 of 40)

← Chapter 09 · Course chapter index · Chapter 11 →

Continue to the next authored lesson.