Ethics of Information Security

Transcription

1 Ethics of Information Security Sara Afshar Professional Ethics Course MRTC/Mälardalen University 10 May

2 Ethics Ø Distinguishing right from wrong, and good from bad Ø It analyzes the morality of human behaviors, policies, laws and social structures 2

3 Ethics Ø Two theoretical approaches that are most common in ethics: Ø Consequentialist: actions are wrong to the extent that they have bad consequences Ø Deontological: any action is ethical if it conforms to certain overarching rules: do not lie, kill or cheat 3

4 IT Ethics Ø Positive influence Ø Expression for technological relativism: knowledge, truth, and morality exist in relation to culture, society, and historical context, including technology and are not absolute Ø Moral intensity of an act must be taken into account Ø Individualism: his/her own needs as opposed to the group needs à fairness Ø Uncertainty avoidance: individual feels threatened à obeying rules Ø Negative influence Ø Power distance: large power and inequality differences are accepted as normal by the individual Ø Masculine values dominate: earnings, advancement, competitiveness à less recognize vital human needs 4

5 Computer Ethics Ø A field developed in 1980s, [Tavani H., Ethics and Technology: Ethical Issues in an Age of information and Communication Technology H, 2004], [Johnson, D. Computer Ethics, 2000] Ø Analyzes moral responsibilities of computer experts & users and ethical issues in public policy for information technology development and use Ø Is it wrong for corporations to read their employee s ? Ø Is it morally permissible for computer users to copy copyrighted software? Ø Should people be free to put controversial information online without censorship? 5

6 Computer Security and Ethics Ø Importance of ethics of computer security Ø Valuable information and system resources should be protected Ø Unauthorized revelation, and manipulation of information should be avoided Ø System security: system resources: software, hardware Ø Information security: system data Ø Confidentiality: privacy Ø Integrity: loss of data Ø Availability: access 6

7 Computer Security and Ethics Ø How does computer security pose ethical issues? Ø Economic harm Ø System security qvaluable hardware and software may be damaged qservice may become unavailable qresulting in losses of time, money and resources Ø information security: even higher economic costs qcause severe economic losses qpersonal, cultural, social values qpsychological or emotional harm Ø Safety-critical systems 7

8 Computer Security and Ethics Ø How does confidentiality of information pose ethical issues? Ø Harms, rights violations Ø Third parties may violate the confidentiality of information by accessing, copying and disseminating it à violate property rights Ø Including intellectual property rights Ø Exclusive ownership of information Ø Papers and journals copyright 8

9 Computer Security and Ethics Ø How does confidentiality of information pose ethical issues? Ø Privacy violation Ø Breaches of confidentiality Ø Sharing internal chats/discussions/decisions of a company can damage its reputation Ø Not enough secured online credit card transactions can harm e-banking 9

10 Computer Security and Ethics Ø How does availability of information pose ethical issues? Ø Freedom violation by blocking the availability Ø Freedom of information Ø Right to access and use public information access to information has become a moral right of citizens in the information age, because information has become a primary social good: a major resource necessary for people to be successful in society Jeroen van den Hoven, Ethics and a philosophy professor at Delft University of Technology 10

11 Computer Security and Ethics Ø How does availability of information pose ethical issues? Ø Freedom violation by blocking the availability Ø Freedom of information Ø Right to access and use public information Ø A study has been conducted to investigate the practice of FOI Ø To what extent, if any, are the promises made by FOI legislation are supported by the practice in the countries of study? Ø US Ø Sweden Ø Australia Ø South Africa Ø Thailand 11

12 Computer Security and Ethics Ø Ethical Issues in Computer Security Ø Hacking and computer crime Ø Cyberterrorism and information warfare Ø Moral responsibilities of information security experts 12

13 Hacking and Computer Crime Ø Unauthorized access to computer resources Ø Share knowledge and data Ø Steal information Ø Corrupt data or system functionality Ø Self-identified hackers distinguish Ø Non-harming intruding: hacking Ø Corruptive intruding: cracking 13

14 Hacking and Computer Crime Ø Non-harming intruding: hacking Ø Frees data to the benefit of all: hacker code of ethics! Ø Contradiction to intellectual property Ø Violate privacy Cybercrime? Ashley Madison data breach 14

15 Cyberterrorism Ø execution of politically motivated hacking operations intended to cause grave harm, that is, resulting in either loss of life or severe economic loss, or both defined by Herman Tavani, Professor Emeritus of Philosophy at Rivier University, USA Ø Where are the boundaries between cyberterrorism, cybercrime? 11 Sep

16 Information Warfare Ø Attack to the information and information systems Ø Spread propaganda Ø Jamming of the communication systems Ø Hack into important infrastructure of enemy 16

17 Moral Responsibilities of IS Experts Ø Information security (IS) experts Ø individuals who maintain system and information security Ø Correctness Ø Reliability Ø Availability Ø Safety and security Ø Ethics codes of IS experts are not described in detail Ø ISSA (Information Systems Security Association) Ø Only states: members should perform all professional activities and duties in accordance with all applicable laws and the highest ethical principles! Ø What these ethical principles are? Ø How should they be applied? 17

18 References Ø Brey, P. (2007), Ethical Aspects of Information Security and Privacy, Security, Privacy, and Trust in Modern Data Management, M. Petković and W. Jonker (Eds.), Springer Berlin Heidelberg, pp Ø S. Chatterjee, J. S. Valacich and S. Sarker, "Unethical Use of Information Technology: A Two-Country Study," System Science (HICSS), th Hawaii International Conference on, Maui, HI, 2012, pp doi: /HICSS Ø Hoven, J. van den (1995). Equal Access and Social Justice: ETHICOMP95, vol. 1 information as A Primary Good. Ø Lidberg, J. (2009). The International Freedom of Information Index A Watchdog of Transparency in Practice: Nordicom Review 30, 1, pp Ø ISSA: ISSA Code of Ethics. In: Information Systems Security Association Website. (2005). Cited 14 Mar