Chapter 10 — Ethics and authorized practice

Lesson map

Lesson 10 published. Map, example, EX028.

flowchart TD
  N0["Learning outcomes"]
  N1["10.1 Authorisation first"]
  N2["10.2 Personal data in practice"]
  N3["10.3 Dilemmas and codes"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX028"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["10.1 Authorisation first"]
  N2["10.2 Personal data in practice"]
  N3["10.3 Dilemmas and codes"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX028"]

[Learning outcomes]
    |
    v
[10.1 Authorisation first]
    |
    v
[10.2 Personal data in practice]
    |
    v
[10.3 Dilemmas and codes]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX028]

Learning outcomes

You will (1) explain why authorisation is required before security testing; (2) handle personal data encountered during work ethically; (3) apply professional codes to dilemmas.

10.1 Authorisation first

Lucas wants to test whether Fernway's member login is vulnerable to credential stuffing. Hannah explains that even with good intentions, testing without written authorisation could break laws on computer misuse and could disrupt customers. Authorisation states what may be tested, how, when and by whom, and names a contact for emergencies. It must come from someone with authority over the system. For the shop, that includes the cloud host's rules, which restrict certain tests. Lucas writes a test request, Hannah approves a limited version in a staging environment and the test proceeds safely.

10.2 Personal data in practice

While reviewing logs, Lucas sees member names, addresses and order histories. He learns to access only what the task requires, never to browse out of curiosity and never to copy personal data into personal notes or coursework. When he needs examples for his university assignment, he creates synthetic records instead. Privacy law in many countries requires such care, but the ethical point is simpler: members trusted Fernway with their data for shopping, not for a student's convenience. Respecting that trust is part of professional practice.

10.3 Dilemmas and codes

Lucas faces a dilemma: a friend at another retailer mentions that their checkout page loads scripts from an unknown domain. Should he investigate? Professional codes, such as those of computing societies, emphasise honesty, avoiding harm and respecting authorisation. He does not probe the other site. Instead, he suggests his friend report it internally to their security team. He discusses the case with Dr Bellini, who praises the restraint: helping is right, but acting on systems one is not authorised to test causes harm, even when motivated by concern.

Worked example

Lucas obtains limited written authorisation for a staging test, uses synthetic data for coursework and declines to probe another retailer's site.

Synthetic case. The test request, logs and friend's case are synthetic.

Errors and limits

Laws differ by jurisdiction; seek advice when unsure. Staging environments may not reproduce production behaviour.

Exercises

• EX028 — Authorisation contents. What should a test authorisation specify?
  Show marking criteria

  Rubric: 3 = what, how, when, by whom and an emergency contact;; 2 = four;; 1 = vague;; 0 = none.
• EX029 — Coursework data. What does Lucas use for coursework examples?
  Show marking criteria

  Rubric: 3 = synthetic records, not member data;; 2 = synthetic;; 1 = real;; 0 = none.
• EX030 — Friend's report. What did Lucas advise his friend to do about the suspicious script?
  Show marking criteria

  Rubric: 3 = report it internally to their own security team;; 2 = report;; 1 = probe it;; 0 = none.

Synthesis

Authorised practice and respect for personal data are prerequisites for any security work, however well meant.

Continue studying — chapter 10 of 40

← Chapter 09 (draft) · Course chapter index · Chapter 11 (draft) →