Chapter 10 — Ethics and authorized practice

Lesson map

Lesson 10 published. Map, example, EX028.

flowchart TD
  N0["Learning outcomes"]
  N1["10.1 Authorisation first"]
  N2["10.2 Professional codes"]
  N3["10.3 Sensitive data"]
  N4["10.4 Reporting problems"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX028"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["10.1 Authorisation first"]
  N2["10.2 Professional codes"]
  N3["10.3 Sensitive data"]
  N4["10.4 Reporting problems"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX028"]

[Learning outcomes]
    |
    v
[10.1 Authorisation first]
    |
    v
[10.2 Professional codes]
    |
    v
[10.3 Sensitive data]
    |
    v
[10.4 Reporting problems]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX028]

Learning outcomes

You will (1) identify ethical duties; (2) work only with authorisation; (3) handle sensitive data responsibly.

10.1 Authorisation first

Security students learn about weaknesses, and that knowledge carries responsibility. Priya's course is clear: testing or examining any network requires written permission from its owner, defining scope, time and methods. Without permission, even well-meant checks can be illegal and can disrupt services. When the clinics later agree to work with Northbridge, the agreement states exactly what Priya may review, mostly configurations and logs provided by the clinic team, and states that she will not run tests against live clinical systems.

10.2 Professional codes

Professional bodies publish codes of ethics that emphasise avoiding harm, honesty, respecting privacy and working within one's competence. Priya reads her university's code and notes how it applies: she should report findings honestly even when they are embarrassing for the partner, avoid claiming expertise she lacks, and protect information she sees. Codes do not answer every question, but they give a starting point when a situation is unclear and a shared standard that others can hold her to. When unsure, she asks her supervisor before acting rather than after.

10.3 Sensitive data

Clinic networks carry health information, which is among the most sensitive personal data. Even logs can reveal it: a device name may include a patient room, and timing of connections can reveal appointments. Priya works only with sanitised data where names and identifiers are replaced, stores it on encrypted university storage and deletes it at the end of the project as agreed. She never copies data to personal devices. These steps are part of the agreement and are checked by her supervisor, Dr Tomasz Kowal.

10.4 Reporting problems

If Priya notices a serious weakness, she reports it promptly to the clinic's IT lead through the agreed channel, not to classmates or online. If she makes a mistake, such as accessing a file outside scope, she reports it immediately. Honest reporting builds trust and lets the partner act. Concealing problems, even small ones, damages trust and can leave patients and staff exposed. The course treats prompt, private, honest reporting as a core skill, not an optional courtesy. Reports state facts, evidence and suggested next steps, without speculation.

Worked example

Priya's project agreement lists permitted activities, data handling rules, a reporting contact and an end date for data deletion.

Synthetic case. The agreement is synthetic.

Errors and limits

Assuming permission because a system is easy to reach is a common and serious error.

Exercises

• EX028 — Agreement contents. List three things a project agreement should state.
  Show marking criteria

  Rubric: 3 = scope, data handling, reporting contact or end date;; 2 = two;; 1 = one;; 0 = none.
• EX029 — Out-of-scope mistake. What should Priya do if she accidentally opens an out-of-scope file?
  Show marking criteria

  Rubric: 3 = report immediately to the agreed contact;; 2 = tell someone;; 1 = ignore;; 0 = none.
• EX030 — Hidden health data. How can network logs reveal health information?
  Show marking criteria

  Rubric: 3 = device names, connection timing linked to patients;; 2 = names;; 1 = they cannot;; 0 = none.

Synthesis

Authorisation, honesty and careful data handling come before any technical work.

Continue studying — chapter 10 of 40

← Chapter 09 (draft) · Course chapter index · Chapter 11 (draft) →