Chapter 10 — Ethics and authorized practice
Lesson map
Lesson 10 published. Map, example, EX028.
flowchart TD
N0["Learning outcomes"]
N1["10.1 Ethical principles"]
N2["10.2 Working within authorization"]
N3["10.3 Handling findings responsibly"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX028"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["10.1 Ethical principles"]
N2["10.2 Working within authorization"]
N3["10.3 Handling findings responsibly"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX028"]
[Learning outcomes]
|
v
[10.1 Ethical principles]
|
v
[10.2 Working within authorization]
|
v
[10.3 Handling findings responsibly]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX028]
Learning outcomes
You will (1) apply ethical principles to security work; (2) work only within authorization; (3) handle findings responsibly.
10.1 Ethical principles
Security students gain knowledge that could harm people if misused. Sofia's course discusses principles from professional codes: avoid harm, be honest, respect privacy, and act within the law and agreements. Applied to the cooperative, these mean she will not look at member data she does not need, will report problems honestly even if embarrassing, and will never test systems she has not been asked to test. Dr Asante stresses that ethics is practical: it shows up in small daily choices, such as closing a spreadsheet of member names when a visitor enters the room or a screen is shared.
10.2 Working within authorization
Before any security work, Sofia obtains written permission from the cooperative's board describing what she may examine, when, and with which data. Her authorization covers the test ledger, synthetic data and read-only access to configuration. It excludes members' devices, the shop's payment terminal and any public blockchain. If she notices something outside scope, she reports it rather than investigating. Written scope protects everyone: the cooperative knows what is happening, and Sofia can show she acted properly. Working outside authorization, even with good intentions, can be unlawful and damages trust that is hard to rebuild.
10.3 Handling findings responsibly
When Sofia finds that a test configuration file contains a coordinator's email address, she reports it privately to the board's contact, explains the risk in plain words and suggests removing it. She does not share the finding publicly or with classmates. The board fixes it within a day and thanks her. Responsible handling means reporting to the people who can fix a problem, giving them time, and keeping details confidential. EthTrust and other guidance assume reviewers behave this way. Sofia records the finding, the report date and the fix date in a simple log for the course.
Worked example
Sofia works under a written scope covering the test ledger and synthetic data, and privately reports an email address found in a configuration file.
Synthetic case. The authorization and finding are synthetic.
Errors and limits
Investigating systems outside written scope, even helpfully, can be unlawful and erode trust.
Exercises
- EX028 — Scope exclusions. Name one item outside Sofia's scope. Rubric: 3 = the shop's payment terminal;; 2 = members' devices;; 1 = the test ledger;; 0 = none.
- EX029 — Out-of-scope action. What should she do if she notices something outside scope? Rubric: 3 = report it rather than investigate;; 2 = report;; 1 = investigate quietly;; 0 = none.
- EX030 — Finding handled. What did Sofia find and report? Rubric: 3 = a coordinator's email in a test configuration file;; 2 = an email;; 1 = a stolen key;; 0 = none.
Synthesis
Ethical principles, written authorization and private reporting make security work trustworthy.
Continue studying — chapter 10 of 40
← Chapter 09 (draft) · Course chapter index · Chapter 11 (draft) →