Chapter 10 — Ethics and authorized practice

Chapter 10 — Ethics and authorized practice

Lesson map

Lesson 10 published. Map, example, EX028.

flowchart TD
  N0["Learning outcomes"]
  N1["10.1 Authorisation"]
  N2["10.2 Personal data"]
  N3["10.3 Responsible reporting"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX028"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["10.1 Authorisation"]
  N2["10.2 Personal data"]
  N3["10.3 Responsible reporting"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX028"]

[Learning outcomes]
    |
    v
[10.1 Authorisation]
    |
    v
[10.2 Personal data]
    |
    v
[10.3 Responsible reporting]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX028]

Learning outcomes

You will (1) work only within authorised scope; (2) handle personal data ethically during governance work; (3) report findings responsibly.

10.1 Authorisation

Sofia's work at Elmfield needs written authorisation. Dr. Haddad explains that even well-meant checks, such as testing whether a password is weak, can break rules or laws if done without permission. Elmfield's director signs a letter defining what Sofia may do: read inventory and account exports, interview staff and review documents. Active testing of systems is excluded. She learns that a clear scope protects her, the organisation and the people whose data she may see. Her letter also tells Elmfield staff what to expect, so an interview request does not look like an investigation.

10.2 Personal data

Account exports and leaver lists contain personal data. Sofia stores them only on Elmfield's encrypted laptop provided for her placement, removes names when sharing results with her tutor and deletes copies at the end. She learns that governance work must follow the same data protection principles it promotes: use the minimum data needed, keep it secure and keep it only as long as necessary. Doing otherwise would undermine her credibility and could harm tenants and staff. Removing names before sharing with her tutor shows the minimisation principle applied to her own placement work.

10.3 Responsible reporting

When Sofia finds the exposed remote desktop service, she reports it immediately to Elmfield's IT lead rather than waiting for her final report, because attackers could exploit it at any time. She describes it factually, without blaming the person who set it up. She learns that urgent findings need fast, private reporting through agreed channels, while lower risks can wait for the written report. Responsible reporting balances speed, accuracy and respect for colleagues. Reporting it privately to the IT lead, rather than in a meeting, also avoids drawing attention to the exposure before it is closed.

Worked example

Sofia works under a signed scope, protects personal data in her own work and reports an urgent finding promptly and without blame.

Synthetic case. The scope letter and findings are synthetic.

Errors and limits

Scopes can be ambiguous. Urgency judgements vary.

Exercises

• EX028 — Excluded activity. Which activity was excluded from Sofia's scope? Rubric: 3 = active testing of systems;; 2 = testing;; 1 = vague;; 0 = none.
• EX029 — Data handling. How did Sofia handle personal data from exports? Rubric: 3 = encrypted laptop, names removed when sharing, deleted at end;; 2 = minimise;; 1 = vague;; 0 = none.
• EX030 — Urgent report. Why report the remote desktop exposure immediately? Rubric: 3 = attackers could exploit it at any time;; 2 = urgency;; 1 = vague;; 0 = none.

Synthesis

Authorised scope, careful data handling and responsible reporting are the ethics of GRC work.

Continue studying — chapter 10 of 40

← Chapter 09 (draft) · Course chapter index · Chapter 11 (draft) →