Title: Ethics and Information Security
Course: IN 2001 Principle of Information Assurance > Section: Module 3: Chapter Three

Ethics and Information Security

1. Many professional groups have explicit rules governing ethical behavior in the workplace.
2. The information technology field and the information security field do not have a binding code of ethics.
3. Instead, professional associations (such as the Association for Computing Machinery and the Information Systems Security Association) and accreditation agencies (such as ISC2) work to establish the profession’s ethical codes of conduct.
4. The “Ten Commandments of Computer Ethics” from the Computer Ethics Institute are:

1)    Thou shalt not use a computer to harm other people.
2)    Thou shalt not interfere with other people's computer work.
3)    Thou shalt not snoop around in other people's computer files.
4)    Thou shalt not use a computer to steal.
5)    Thou shalt not use a computer to bear false witness.
6)    Thou shalt not copy or use proprietary software for which you have not paid.
7)    Thou shalt not use other people's computer resources without authorization or proper compensation.
8)    Thou shalt not appropriate other people's intellectual output.
9)    Thou shalt think about the social consequences of the program you are writing or the system you are designing.
10)Thou shalt always use a computer in ways that ensure consideration and respect for your fellow humans.

Ethical Differences Across Cultures

1. Cultural differences can make it difficult to determine what is and is not ethical, especially when it comes to the use of computers.
2. Difficulties arise when one nationality’s ethical behavior violates the ethics of another national group.
3. Approximately 90 percent of all software is created in the United States.
4. A study published in 1999 examined computer use ethics of nine nations: Singapore, Hong Kong, the United States, England, Australia, Sweden, Wales and the Netherlands:

- This study selected a number of computer-use vignettes and presented them to students in universities in these nine nations
- The responses indicated a degree of ethical sensitivity or knowledge about the performance of the individuals in the short case studies
- The scenarios were grouped into three categories of ethical computer use: software license infringement, illicit use, and misuse of corporate resources.

Software License Infringement

1. Overall, most of the nations studied by Dr.Whitman had similar attitudes toward software piracy.
2. Statistically speaking, only the United States and the Netherlands had attitudes that differed substantially from those of all other countries examined.
3. The United States was significantly less tolerant of piracy, while the Netherlands was significantly more permissive.
4. Although a number of studies have reported that the Pacific Rim countries of Singapore and Hong Kong are hotbeds of software piracy, this study found their tolerance for copyright infringement to be moderate.
5. This could mean is that the individuals surveyed understood what software license infringement was but felt either that their use was not piracy, or that their society permitted this piracy in some way.
6. Peer pressure, the lack of legal disincentives, the lack of punitive measures, or any one of a number of other reasons could also explain why these alleged piracy centers were not oblivious to intellectual property laws.

Illicit Use

1. The study respondents unilaterally condemned viruses, hacking, and other forms of system abuse.
2. There were, however, different degrees of tolerance for such activities among the groups.
3. The low overall degree of tolerance for illicit system use may be a function of the easy association between the common crimes of breaking and entering, trespassing, theft, and destruction of property to their computer-related counterparts.

Misuse of Corporate Resources

1. In general, individuals displayed a rather lenient view of personal use of company equipment.
2. Only Singapore and Hong Kong view personal use of company equipment as unethical.
3. With the exceptions of Singapore and Hong Kong, it is apparent that many individuals, regardless of cultural background, feel that if an organization does not specifically forbid personal use of its computing resources, such use is acceptable.
4. Overall, the researchers found that there is a general agreement among nationalities as to what is acceptable or unacceptable computer use.
5. There is, however, a range of views as to whether some actions are moderately or highly unacceptable.
6. This study underscores the intercultural similarities that exist as much as it describes the differences between cultures.

Ethics and Education

1. Employees must be trained and kept aware of a number of topics related to information security, not the least of which is the expected behaviors of an ethical employee.
2. This is especially important in information security, as many employees may not have the formal technical training to understand that their behavior is unethical or even illegal.
3. Proper ethical and legal training is vital to creating an informed, well prepared and low-risk system user.

Deterrence to Unethical and Illegal Behavior

1. It is the responsibility of information security personnel to do everything in their power to deter illegal, immoral or unethical behavior and to use policy, education and training and technology to protect information and systems.
2. Many security professionals understand the technology aspect of protection but underestimate the value of policy.
3. There are three general causes of unethical and illegal behavior: ignorance, accident and intent.
4. Deterrence is the best method for preventing an illegal or unethical activity.  Laws, policies and technical controls are all examples of deterrents.
5. It is generally agreed that laws and policies and their associated penalties only deter if three conditions are present:

- Fear of penalty
- Probability of being caught
- Probability of penalty being administered