- Everyone Knows What "Cybersecurity" Means
- We Can Measure How Secure Our Systems Are
- The Primary Goal of Cybersecurity Is Security
- Cybersecurity Is About Obvious Risks
- Sharing More Cyber Threat Intel Will Make Things Better
- What Matters to You Matters to Everyone Else
- Product X Will Make You Secure
- Macs Are Safer Than PCs, Linux Is Safer Than Windows
- Open Source Software Is More Secure Than Closed Source Software
- Technology X Will Make You Secure
- Process X Will Make You Secure
- Faerie Dust Can Make Old Ideas Magically Revolutionary
- Passwords Should Be Changed Often
- Believe and Fear Every Hacking Demo You See
- Cyber Offense Is Easier Than Defense
- Operational Technology (OT) Is Not Vulnerable
- Breaking Systems Is the Best Way to Establish Yourself
- Because You Can, You Should
- Better Security Means Worse Privacy
- Further Reading
This chapter is from the book
This chapter is from the book
This chapter is from the book
Because You Can, You Should
There is an endless amount of cybersecurity-related activity and behavior that is legal and technically achievable, yet inadvisable. Simply because we can do something does not mean we should. We could run through the data center shouting the equivalent of “Fire,”69 but we do not.
Let’s start by reiterating that much of what we do in the field is based on “trust.” That extends to the trust of people and the profession. Consider the generic and stereotypical reputation of used-car salespeople: It isn’t always positive. That is perhaps unfair to most of those people, but the lack of candor by a few has tarnished the reputations of them all. The same can be said of politicians and, in some places, law enforcement personnel; unethical behavior by a few makes an entire class of people look bad and lessens trust. We’ll return to this theme in several places in the book and highlight professional organizations’ roles. Still, we want this concept to be central to these discussions: For cybersecurity to be successful and for cybersecurity professionals to be trusted, we (collectively) need to place a strong emphasis on behaving ethically—not simply doing things because of law or convenience, but because they are the right things to do. That also means encouraging others to do what is right and condemning improper behavior. A “nifty hack” that hurts an innocent party or endangers the public is unacceptable, no matter how clever it might be.
Responsible disclosure of vulnerabilities, for instance, is not required by law in the United States.70 A security team that discovers a critical vulnerability in a popular web browser could legally release it publicly without notifying the vendor, but doing so risks widespread exploitation and compromise. The researchers might not exploit it for their own gain, but they are leaving it open for others to do that. Leaving the door open for the robbers is almost as bad as joining them in their caper.
Morals and ethics are distinguishable and distinct from the law, but whether we should or should not is informed by both law and ethics. Many professions, professional organizations, and industries have codes of ethics and professional conduct. The Association for Computing Machinery (ACM) has a very good one.71 The first sentence acknowledges the importance: “Computing professionals’ actions change the world.” This code speaks to the duties of computing professionals for the public good, care for society and human well-being, responsibility for ethical practice, and respect for privacy. The Forum of Incident Response and Security Teams (FIRST) also has a notable code of ethics.72
Many accredited academic computer science and engineering programs require a study of ethics. The Accreditation Board for Engineering and Technology (ABET) says that graduates will “Recognize professional responsibilities and make informed judgments in cybersecurity practice based on legal and ethical principles.”73
In most research environments, an Institutional Review Board (IRB) reviews research proposals to protect the rights and welfare of human research subjects. If we want to study phishing by sending fake emails to people, an IRB will consider the potential harm to the participants.
Lastly, consider how other people will perceive our choices. We might get a lot of pushback and questions about the project or decision, even if we felt it was entirely right to do. Would we feel comfortable if the decision was front-page headlines in the news?74
Bottom line: If we find ourselves saying that something is technically feasible or technically legal, that situation should give us pause to reconsider the action.