Chapter 10 — Engineering ethics and safety

Lesson map

Lesson 10 published. Map, example, EX028.

flowchart TD
  N0["Learning outcomes"]
  N1["10.1 Ethics in awareness work"]
  N2["10.2 An ethical simulation design"]
  N3["10.3 Safety and wellbeing"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX028"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["10.1 Ethics in awareness work"]
  N2["10.2 An ethical simulation design"]
  N3["10.3 Safety and wellbeing"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX028"]

[Learning outcomes]
    |
    v
[10.1 Ethics in awareness work]
    |
    v
[10.2 An ethical simulation design]
    |
    v
[10.3 Safety and wellbeing]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX028]

Learning outcomes

You will (1) apply engineering ethics to security awareness work; (2) design ethical phishing simulations; (3) balance safety duties with staff wellbeing.

10.1 Ethics in awareness work

Prof. Kerr reminds the class that engineers owe duties to the public, employers and colleagues. Awareness programmes affect people's dignity and trust. Phishing simulations, in particular, involve deception. Aiko learns that deception can be justified only when it serves a clear safety purpose, is approved by the organisation, avoids harm and is followed by honest explanation. Treating colleagues as adversaries to be caught undermines the cooperation that security depends on, as Adams and Sasse (1999) argued. She writes these conditions at the start of her simulation design notes.

10.2 An ethical simulation design

Aiko drafts rules for Greyford: simulations are approved by management and staff representatives; staff are told in general that simulations happen; no lures exploit fear about pay, health, family or redundancy; landing pages never ask for real passwords and record only that a link was opened; results are reported only in aggregate; nobody is disciplined for clicking; and everyone who clicks sees a short, kind explanation with how to report next time. She cites the NIST Phish Scale to keep difficulty consistent.

10.3 Safety and wellbeing

Greyford's control room operators handle safety-critical alarms. Aiko recommends that simulations never be sent to control room consoles during shifts, because distraction could affect water treatment. Instead, operators receive simulations on office accounts at quieter times. She also proposes a channel for staff to raise concerns about any simulation. Ethics and safety align here: a simulation that distracts an operator during an alarm would create a real risk to the public it is meant to protect. The plant manager approves the rule.

Worked example

Aiko states conditions for justified deception, drafts seven ethical simulation rules and keeps simulations away from safety-critical consoles.

Synthetic case. Rules and settings are synthetic; Adams and Sasse (1999) and the NIST Phish Scale are real.

Errors and limits

Even ethical simulations can upset some staff. Rules need review as threats change.

Exercises

• EX028 — Justified deception. When can deception in simulations be justified?
  Show marking criteria

  Rubric: 3 = clear safety purpose, approval, no harm and honest explanation afterwards;; 2 = conditions;; 1 = always;; 0 = none.
• EX029 — Forbidden lures. Which lure themes are excluded?
  Show marking criteria

  Rubric: 3 = pay, health, family and redundancy fears;; 2 = two;; 1 = vague;; 0 = none.
• EX030 — Control room rule. Why avoid simulations on control room consoles during shifts?
  Show marking criteria

  Rubric: 3 = distraction could affect water treatment safety;; 2 = safety;; 1 = vague;; 0 = none.

Synthesis

Ethical simulations are approved, transparent, harmless, blame-free and kept away from safety-critical work.

Continue studying — chapter 10 of 50

← Chapter 09 (draft) · Course chapter index · Chapter 11 (draft) →