Title: Codes of Ethics and Professional Organizations
Course: IN 2001 Principle of Information Assurance > Section: Module 3: Chapter Three

Codes of Ethics and Professional Organizations

1. Many professional organizations have established codes of conduct or codes of ethics that members are expected to follow.
2. Codes of ethics can have a positive effect on an individual’s judgment regarding computer use.
3. Unfortunately, many employers do not encourage their employees to join these professional organizations.
4. Security professionals must act ethically and according to the policies and procedures of their employers, their professional organizations and the laws of society.

Major Professional Organizations for IT

Association of Computing Machinery (ACM)

- The ACM (www.acm.org) is a respected professional society, originally established in 1947, as “the world's first educational and scientific computing society.”
- The ACM’s code of ethics requires members to perform their duties in a manner befitting an ethical computing professional.  The code contains specific references to protecting the confidentiality of information, causing no harm, protecting the privacy of others and respecting the intellectual property and copyrights of others.

International Information Systems Security Certification Consortium Inc.(ISC)^2

- The (ISC)^2 (www.isc2.org) is a nonprofit organization that focuses on the development and implementation of information security certifications and credentials.
- The code of ethics put forth by (ISC)^2 is primarily designed for information security professionals who have earned a certification from (ISC)^2.
- This code focuses on four mandatory canons:
  - Protect society, the commonwealth, and the infrastructure
  - Act honorably, honestly, justly, responsibly and legally
  - Provide diligent and competent service to principals
  - Advance and protect the profession

System Administration, Networking, and Security Institute (SANS)

- SANS (www.sans.org) is a professional organization with a large membership dedicated to the protection of information and systems
- SANS offers a set of certifications called the Global Information Assurance Certification or GIAC

Information Systems Audit and Control Association (ISACA)

- ISACA (www.isaca.org) is a professional association with a focus on auditing, control and security
- Although it does not focus exclusively on information security, the Certified Information Systems Auditor (CISA) certification does contain many information security components
- The ISACA also has a code of ethics for its professionals.  It requires many of the same high standards for ethical performance as the other organizations and certifications

Information Systems Security Association (ISSA)

- ISSA (www.issa.org) is a nonprofit society of information security professionals
- As a professional association, its primary mission is to bring together qualified practitioners of information security for information exchange and educational development
- ISSA also promotes a code of ethics whose focus is “promoting management practices that will ensure the confidentiality, integrity and availability of organizational information resources.”

Key U.S. Federal Agencies

1. Discuss the key U.S. federal agencies charged with the protection of American information resources and the investigation of threats to or attacks on, these resources.
2. Explain that these agencies include the Department of Homeland Security (DHS), the Federal Bureau of Investigation’s National Infrastructure Protection Center (NIPC), the National Security Administration and the U.S. Secret Service.
3. Describe the Department of Homeland Security (DHS), which was created in 2003 through the Homeland Security Act of 2002, which was passed in response to the events of September 11, 2001.
  - DHS is made up of five directorates, or divisions, through which it carries out its mission of protecting the people, as well as the physical and informational assets, of the United States
  - The Directorate of Information & Infrastructure works to create and enhance capabilities used to discover and respond to attacks on national information systems and critical infrastructure
  - This effort is guided by a continuing examination of the vulnerabilities throughout the national infrastructure
  - It sponsors the emerging best practices developed to counter threats and weaknesses in the system
4. Describe the National InfraGard Program began as a cooperative effort between the FBI’s Cleveland field office and local technology professionals, which was established in January of 2001.
  - Every FBI field office has established an InfraGard chapter and collaborates with public and private organizations and the academic community to share information about attacks, vulnerabilities and threats
  - The National InfraGard Program serves its members in four basic ways:
    - Maintains an intrusion alert network using encrypted e-mail
    - Maintains a secure Web site for communication about suspicious activity or intrusions
    - Sponsors local chapter activities
    - Operates a help desk for questions
5. Describe the National Security Agency (NSA), which is “the nation's cryptologic organization. It coordinates, directs and performs highly specialized activities to protect U.S. information systems and produce foreign intelligence information.”
  - The NSA is responsible for signal intelligence and information system security
  - The NSA’s Information Assurance Directorate (IAD) provides information security “solutions including the technologies, specifications and criteria, products, product configurations, tools, standards, operational doctrine and support activities needed to implement the project, detect and report and respond elements of cyber defense.”
  - Prominent among the NSA’s efforts and activities in the information security arena are the Information Security Outreach programs
  - The NSA recognizes universities that not only offer information security education, but ones that have also integrated information security philosophies and efforts into the internal operations of the schools
  - The NSA also has a program to certify curriculum in information security
  - The Information Assurance Courseware Evaluation process examines information security courses in an institution and, if accepted, provides a three-year accreditation
  - Graduates of these programs receive certificates that indicate this accreditation
6. Describe the U.S. Secret Service, which is a department within the Department of the Treasury.
  - The Secret Service has been charged with the responsibility of detecting and arresting any person committing a U.S. federal offense relating to computer fraud and false identification crimes
  - This represents an extension of the original mission of protecting U.S. currency to areas of communications fraud and abuse—a logical extension, given that the communications networks of the U.S. carry more funds than all of the armored cars in the world combined