◇ OpenCyber Academy
Bachelor's · Chapter 10 · English

Chapter 10 — Ethics and authorized practice

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 10 — Ethics and authorized practice

Lesson map

Lesson 10 published. Map, example, EX028.

flowchart TD
  N0["Learning outcomes"]
  N1["10.1 Authority"]
  N2["10.2 Privacy"]
  N3["10.3 Conflicts of interest"]
  N4["10.4 Confidentiality"]
  N5["10.5 Authorised testing"]
  N6["10.6 Proportionality"]
  N7["10.7 Reporting misconduct"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX028"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["10.1 Authority"]
  N2["10.2 Privacy"]
  N3["10.3 Conflicts of interest"]
  N4["10.4 Confidentiality"]
  N5["10.5 Authorised testing"]
  N6["10.6 Proportionality"]
  N7["10.7 Reporting misconduct"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX028"]

[Learning outcomes]
    |
    v
[10.1 Authority]
    |
    v
[10.2 Privacy]
    |
    v
[10.3 Conflicts of interest]
    |
    v
[10.4 Confidentiality]
    |
    v
[10.5 Authorised testing]
    |
    v
[10.6 Proportionality]
    |
    v
[10.7 Reporting misconduct]
    |
    v
[Worked example] --> [Exercise EX028]

Learning outcomes

You will (1) apply ethical principles to SOC work at a university; (2) act within authorisation and policy; (3) protect privacy of students and staff; (4) handle conflicts of interest and peer data.

10.1 Authority

The SOC acts under the university's information security policy, approved by its governing body. Student analysts may view logs only for assigned alerts and may not search for people they know.

During the phishing incident, Lucas was assigned the alerts for s2047 and s3310 and searched only their records. When a classmate asked him whether her own account had been affected, he directed her to the SOC's reporting address rather than looking it up himself, since checking an unassigned account would have gone beyond his authority.

10.2 Privacy

Students and staff expect privacy. The SOC looks at metadata (sign-ins, rule changes, message counts) by default and reads message content only with case approval from Dr. Kim.

For the phishing case, metadata was enough to confirm both compromises: unusual sign-ins, a new rule and a burst of sent mail. Dr. Kim approved one limited content check, the subjects of the messages s2047's rule had forwarded, to see what the attacker had received. Message bodies were never opened, and the approval was recorded in the case file.

10.3 Conflicts of interest

If an alert involves a friend, classmate or lecturer, a student analyst passes it to another analyst. Lucas declares when an alert involves someone in his course.

In week five, an alert involved a lecturer who taught one of Lucas's modules. He declared the connection to the shift lead and the alert went to another analyst. Declaring a conflict is not an admission of wrongdoing; it protects both the person involved and the credibility of the investigation if the case is later reviewed.

10.4 Confidentiality

Analysts sign a confidentiality agreement. Discussing cases outside the SOC, even anonymously, is not allowed.

Lucas found this hard during the phishing campaign, when classmates asked what had happened. He could repeat the university's public notice about the email but nothing about which accounts were affected. Even a vague remark, such as "someone in our year got hacked", could identify a person in a small cohort. Lucas found it easiest to say that he could not discuss SOC work at all, which classmates soon accepted. The same rule applies after the case is closed and after he leaves the SOC.

10.5 Authorised testing

Phishing simulations and other tests are approved in writing by Dr. Kim and communicated in policy; analysts never run their own tests on university systems.

When Lucas wanted to see how many students would report a mock phishing email, he wrote a proposal rather than sending one. Dr. Kim approved a simulation for the following term with a defined audience, a harmless landing page and a notice in the security policy. Running it without approval could have caused alarm and harmed trust in genuine warnings.

10.6 Proportionality

Responses match the risk: resetting a compromised account is proportionate; suspending a student's network access without evidence is not.

For s2047, the evidence of an external forwarding rule and mass sending justified an immediate reset and session revocation. For a student whose only sign was a single sign-in through a foreign mobile gateway, the proportionate step was to check other signals and, if needed, ask the student, not to lock the account while they were away and depending on it.

10.7 Reporting misconduct

If an analyst sees misuse of SOC access, they report it to Dr. Kim.

Reports go directly to Dr. Kim rather than through other students, so nobody has to confront a peer. Queries in the SOC database are logged, which allows a report to be checked against the record. Dr. Kim treats reports confidentially and protects the person who made them from retaliation, because the SOC's access is only acceptable if misuse is caught and dealt with promptly and fairly.

Records of access

Every log search by an analyst is recorded by the SIEM. Dr. Kim reviews a sample monthly, so misuse would be noticed and analysts know their access is accountable.

Worked example

During the campaign, another student analyst suggests reading s2047's inbox to see what the attacker read. Lucas points out that metadata (rule creation, sent counts) answers the immediate questions and that content access needs Dr. Kim's approval. She approves a limited review of the forwarded messages' subjects only.

Synthetic case. Policies and events are invented.

Errors and limits

Policies cannot foresee every case; ask when unsure.

Exercises

Synthesis

Ethical SOC practice means acting within authority, protecting privacy, declaring conflicts and keeping responses proportionate.

Continue studying — chapter 10 of 40

← Chapter 09 (draft) · Course chapter index · Chapter 11 (draft) →