OpenCyber Academy
Postgraduate · Chapter 4 · English
Course code: OCA-154Chapter 04: OCA-154-C004

Chapter 4 — Advanced risk and ethics

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 04 published. Map, example, EX016.

flowchart TD
  N0["Learning outcomes and connection"]
  N1["4.1 Why specialists face harder ethical questions"]
  N2["4.2 Proportionality and necessity"]
  N3["4.3 Competing duties"]
  N4["4.4 Confidentiality and privilege"]
  N5["4.6 The review record"]
  N6["Chapter synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
  N6 --> EX["Worked example"]
  EX --> Q["Exercise EX016"]

Logical drawing

flowchart LR
  N0["Learning outcomes and connection"]
  N1["4.1 Why specialists face harder ethical questions"]
  N2["4.2 Proportionality and necessity"]
  N3["4.3 Competing duties"]
  N4["4.4 Confidentiality and privilege"]
  N5["4.6 The review record"]
  N6["Chapter synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX016"]

[Learning outcomes and connection]
    |
    v
[4.1 Why specialists face harder ethical questions]
    |
    v
[4.2 Proportionality and necessity]
    |
    v
[4.3 Competing duties]
    |
    v
[4.4 Confidentiality and privilege]
    |
    v
[4.6 The review record]
    |
    v
[Chapter synthesis]
    |
    v
[Worked example] --> [Exercise EX016]

Learning outcomes and connection

You will be able to (1) apply proportionality, necessity and least intrusion to investigative and monitoring requests; (2) handle competing duties — to the organization, to employees, to customers and to the law; (3) design a review record that makes an ethical decision auditable; and (4) recommend a less intrusive authorized plan that still answers the question. Chapter 3 dealt with evidence quality; this chapter deals with the legitimacy of obtaining evidence at all. Chapter 7 adds the legal and privacy integration.

4.1 Why specialists face harder ethical questions

Specialists receive requests from executives that practitioners never see: "monitor everyone in finance", "read the union representative's email", "keep all logs forever". They also hold the technical means to comply. Ethical competence here is the ability to say "not like that — here is a way that answers your real question" and to document why.

Calder's division head made such a request: full keystroke and screen monitoring of all 120 Financial Services staff for three months, after one alert about one analyst's credential. The specialist's answer was to investigate that credential first and strengthen controls for everyone.

4.2 Proportionality and necessity

Data-protection law and human-rights frameworks commonly test interferences with privacy by asking whether they pursue a legitimate aim, are necessary (no less intrusive means would work) and proportionate (the intrusion is balanced against the benefit). The European Data Protection Board's and earlier Article 29 Working Party's guidance on employee monitoring (for example Opinion 2/2017 on data processing at work) applies these ideas to workplace monitoring: blanket, continuous monitoring is rarely proportionate; targeted, time-limited, transparent measures are more defensible. Jurisdictions differ; counsel decides legality, but the specialist designs options that can pass the test.

4.3 Competing duties

Responders owe duties to the employer (protect assets), to employees (fair treatment, privacy), to customers and data subjects (protect their data, be honest about breaches), and to the law (preservation, cooperation, non-interference). These conflict: protecting the organization's reputation can tempt under-reporting; protecting assets can tempt over-monitoring. Name the duties in the decision record and show how the plan honours each.

In Calder's monitoring request, the duty to the employer is met by investigating the credential and adding phishing-resistant MFA; the duty to employees by rejecting blanket keystroke and screen capture; and the duty to the law by leaving the legal basis for any enhanced logging to counsel.

4.4 Confidentiality and privilege

Investigations may involve information subject to legal privilege, trade secrets or third-party confidentiality. Route such matters through counsel; structure engagement of external investigators so that confidentiality is protected (in some jurisdictions, through counsel), without using privilege to hide facts that must be disclosed.

At Calder, counsel instructed the legal hold on the exposed customer-contact export before operations changed anything, and the investigation repository was limited to six named people. Privilege may protect the analysis, but it cannot delay the GDPR notification that the privacy officer determined was required, and the decision log records both without mixing them up.

4.5 Consent and its limits

In employment, consent is rarely "freely given" because of the power imbalance; data-protection authorities generally discourage relying on employee consent for monitoring. Prefer other legal bases established by counsel, combined with transparency (policy notices) and safeguards.

At Calder, option D, 30 days of enhanced logging of data-export events, does not rely on consent. Counsel confirms its legal basis, staff receive notice, and access is limited to two named investigators. Transparency here is a safeguard in its own right: staff know what is logged and why, so the monitoring is less likely to damage trust in the division even though nobody was asked to agree to it.

4.6 The review record

An auditable ethical decision records: the request and requester; the stated aim; options considered with intrusion and effectiveness; legal basis (from counsel); safeguards (scope, duration, access, retention, oversight); the decision and decider; and a review date. This record protects the people affected and the people deciding.

Calder's record for the monitoring request follows this list: request from the division head on 14 June; options A to D with intrusion and effectiveness; legal basis for D to be confirmed by counsel; safeguards for D of 30 days, export events only, two named investigators, deletion after closure and staff notice; decision B plus C with D conditional; decider the CISO with counsel and HR; review on 1 July.

4.7 Worked example (synthetic): broad monitoring request

Fictional. After a single alert that a Financial Services analyst's credential was used from an unknown device, Calder's division head asks the security team to "turn on full keystroke and screen monitoring for all 120 staff in the division for three months".

Aim (legitimate): detect further credential misuse and data theft.

Options: - A: Full keystroke and screen monitoring of 120 staff for 3 months — highly intrusive, captures personal communications and health information typed in personal portals, low necessity (the alert concerns one credential), high legal risk. - B: Investigate the specific credential: IdP sign-ins, device registration, data access by the account; interview the analyst with HR — targeted, proportionate. - C: Strengthen controls for the division: phishing-resistant MFA, device compliance for sign-in, data-loss-prevention rules for bulk exports with alerts reviewed by security — preventive, transparent, low intrusion. - D: Time-limited enhanced logging (30 days) of data-export events for the division, with notice to staff and access limited to two investigators — targeted to the risk, transparent.

Recommendation: B immediately; C as standing improvement; D if B finds evidence of export or the account had access to high-risk data. Reject A as disproportionate and unnecessary.

Review record (excerpt): Request (division head, 14 June); aim; options A–D with intrusion and effectiveness; legal basis to be confirmed by counsel for D; safeguards for D (30 days, export events only, two named investigators, deletion after case closure, staff notice); decision B+C, D conditional; decider: CISO with counsel and HR; review 1 July.

4.8 Common errors and limits

Calder's case shows the first error being avoided. The division head's method was blanket keystroke and screen monitoring, but the aim was to detect further credential misuse and data theft. Options B and C met that aim with far less intrusion, and D stayed available if B found evidence of export. Recording all four options, not only the decision, lets an auditor see that option A was rejected for reasons.

Exercises — chapter 4

Attempt each exercise before opening the worked results. Every case, organization, person, address and number in an exercise is synthetic unless a cited public source is named.

EX016 — Necessity test. Inputs: request to collect all browser history of a team to find who uploaded a confidential file to a personal cloud. Steps: propose two less intrusive means and test each for effectiveness. Rubric: 3 = proxy/DLP logs filtered to known cloud-storage domains and the file's hash/name; file-share audit of who accessed the file; explains why each answers the question; 2 = one; 1 = accepts request; 0 = none.

EX017 — Duties map. Inputs: a breach of customer data caused by a misconfiguration made by a well-liked senior engineer. Steps: map duties to employer, employee, customers and law, and identify one conflict. Rubric: 3 = all four with concrete obligations and a conflict (e.g., fairness to engineer vs complete disclosure of cause); 2 = three; 1 = generic; 0 = none.

EX018 — Review record. Steps: complete the full review record for option D in this chapter's broad-monitoring-request worked example. Rubric: 3 = all fields, safeguards measurable, review date, legal basis left to counsel; 2 = missing safeguards; 1 = narrative; 0 = none.

EX019 — Pushback script. Steps: write a 120-word response to the division head declining option A while offering a path that meets the aim. Rubric: 3 = acknowledges aim, explains risk briefly, offers B/C/D with timelines, invites decision; 2 = declines without alternative; 1 = complies; 0 = none.

EX020 — Privilege boundary. Steps: describe how you would structure an external forensic engagement with counsel's involvement, and one thing privilege must not be used for. Rubric: 3 = engagement via counsel where appropriate, defined scope, separate operational remediation communications, privilege not used to conceal facts subject to disclosure duties; 2 = partial; 1 = misunderstands; 0 = none.

Chapter synthesis

Test every investigative request for aim, necessity and proportionality; map competing duties explicitly; prefer targeted, transparent, time-limited measures; do not rely on employee consent; and keep an auditable record of alternatives, safeguards and review.

Worked answers

EX016. (1) Query proxy and DLP logs for uploads to personal cloud-storage domains in the relevant window, filtered by the file's name, size or hash — answers "who uploaded" if traffic passes the proxy. (2) File-share audit logs showing who accessed or downloaded the file before the upload — narrows the candidate set without browsing data. Both target the question; neither collects unrelated browsing. If both fail (for example, upload from a personal device), escalate with counsel rather than broaden collection automatically.

EX017. Employer: protect assets, investigate cause, fix controls. Employee: fair, non-scapegoating process; due process if discipline is considered; privacy. Customers: honest notification where required; mitigation. Law: notification duties, preservation, cooperation with authorities. Conflict: pressure to describe the cause vaguely to protect the engineer (or the organization) versus accurate disclosure; resolution: describe the technical cause accurately, keep individual names out of external communication, and handle accountability through a just-culture process.

EX018. Request: enhanced export logging for Financial Services. Requester: division head, 14 June. Aim: detect further data export after credential misuse. Options considered: A–D. Chosen: D, conditional on B finding export activity or high-risk access. Legal basis: to be confirmed by counsel before activation. Safeguards: 30 days; export events only (not content); two named investigators; access logged; deletion within 30 days of case closure; notice to staff via policy channel. Decider: CISO with counsel and HR. Review: 1 July or at case closure.

EX019. "I share your concern about further misuse, and we are acting now. Full keystroke and screen monitoring of all 120 staff would capture large amounts of unrelated personal information and is unlikely to be lawful or necessary for one compromised credential. Instead, today we are investigating that account's activity and devices; this week we will require phishing-resistant MFA and compliant devices for the division; and if we find signs of export we can enable 30 days of export-event logging with staff notice. I'd like your approval for this plan by 17:00."

EX020. Counsel engages the external firm under an agreement that defines scope (root cause and exposure analysis) and reporting lines to counsel, where this is recognized in the jurisdiction; technical remediation instructions flow through the incident structure separately so operations are not delayed. Privilege must not be used to withhold facts the organization is legally required to disclose to regulators or affected people, or to obstruct authorities.