Since security intersects so much with privacy, cybersecurity ethics decisions should be on your mind at work.
Being part of a high-performing computer security incident response team (CSIRT) or security operations center (SOC) involves making big, intentional decisions. Increasing the maturity of your team is more than dropping a bag of shiny new tools and technology and then hoping for the best. One of the crucial components to building a successful CSIRT team or SOC are the people pulling the levers of this technology, and the culture in which they have to operate. Chances to train, improve your skill set and form clear career plans are key. Along with them, this culture should include a focus on cybersecurity ethics. You can enforce this with a cybersecurity code of conduct or an IT security code of ethics.
Cybersecurity Ethics Guidance Frameworks
Why Do Cybersecurity Ethics Decisions Matter?
Security teams can be faced with ethical dilemmas in their daily tasks. How so? At first the job description might sound simple: keep the bad guys out. But the truth is deeper.
For example, in a workplace that allows employees to connect their own devices to the network (bring your own device or BYOD), how does your cybersecurity ethics code call for you to handle privacy? When searching for the sources of a data breach, are these personal devices and their content included? What do you do if you encounter data not in line with corporate policy? Or if you find questionable content?
How do you comply with a request to monitor the traffic of a person suspected of potential malicious actions? How can you then align this with human rights?
What do you do if you discover a risk in a common and critical safety component? To be specific, if the vendor does not respond to your requests for having the problem fixed, what do you do?
How do you deal with staff having beliefs strongly and vocally opposing the current government’s actions?
Approaches to Ethical Questions
There are different approaches to answer these questions. To start, you can apply the principles of utilitarian ethics, a reason-based approach to knowing right and wrong. Utilitarian ethics is entirely focused on outcomes. It proposes that the actions that provide the greatest amount of good are the ethical choices. The problem is the outcome of future actions is often difficult to predict. This is especially the case in cybersecurity, where you have so many parameters to take into account.
Next, the rights approach has a strong focus on human dignity. It focuses on our ability to choose freely how we live our lives and make our choices. Judgment of actions is steered by how our actions affect the rights of those around us.
Lastly, the common good approach refers to actions taken or policies that are put in place in order to not only benefit a certain group of people, but also society as a whole. In practice, our decision would be based on how our actions would affect the common good of society or our group.
What Does This Mean for My Team?
Note we did not include specifics on ethical hacking. Ethical hacking is legally breaking into computers and devices to test their defenses. In general, the same principles apply for ethical hacking.
So, how do you apply these ideas to cybersecurity ethics in the real world? Let’s look at the example about finding a flaw in a critical safety component. If the vendor refuses to acknowledge the problem and your estimate is that potential risk is trivial, what do you do? Responsible disclosure is certainly the recommended option.
What if this approach takes a very long time to warn potential victims? Would you take the chance of contacting potential victims proactively, with the risk of leaking details of the risk to the general public, including potential miscreants? On the other hand, hiding the vulnerability will not resolve the problem right away either.
Best Practices
Example Principles
The Forum of Incident Response and Security Teams (FIRST) has dedicated an entire working group on cybersecurity ethics. The group has formulated statements of responsibility, based on the understanding that the public good is always the primary goal. Each principle is augmented by guidelines, which explain how to understand and apply these principles.
Another standard that you can use is the CSIRT Code of Practice (CCoP), as made available by Trusted Introducer. The code contains a list of practices that a team or team member should or must adhere to. Often overlooked is also the fact that the General Data Protection Regulation (GDPR) contains rights for citizens, which can be translated into a code of practice.
Practical Approach for Cybersecurity Ethics
- Do not use a computer to harm other people.
- Protect society and the common good.
- Be trustworthy, meaning only enter commitments you can keep, and uphold trusted connections with people.
- Have a plan for coordinated vulnerability disclosure.
- Respect human rights.
- Disclose data on a need-to-know basis and maintain privacy.
- Comply with legal standards.
Businesses and nations around the world have become more aware of the importance of digital protection and the possible negative outcomes of attacks. They heavily rely on the work done by CSIRTs and SOCs for keeping their systems and data safe and trustworthy. Because of this, security professionals should consider creating a standard code of cybersecurity ethics for business.
Koen Van Impe Security Analyst
