This course examines ethical issues relevant to ethics for cybersecurity professionals, including privacy, professional code of conduct, practical conflicts between engineering ethics and business practices, individual and corporate social responsibility, ethical hacking, information warfare, and cyberwarfare. Students will gain a broad understanding of central issues in cyberethics and the ways that fundamental ethical theories relate to these core issues.<\/p>\n\n\n\n
Reflective Writing Assignment<\/strong><\/p>\n\n\n\n The most important thing I have learned in this course is that Cyber security is not just about technology. Prior to this course, I mostly considered cybersecurity as a means of safeguarding computers, networks, and information against attacks. Through the various scenarios I have gone through, I have gained a greater appreciation of the need to consider privacy, responsibility, trust and the impact technology can have on people in cybersecurity decisions. Three topics that changed and developed my thinking the most were privacy and personal information, professional responsibility, and cyberconflict and information warfare.<\/p>\n\n\n\n Google Street View, GDPR, and Equifax cases have shifted my thinking when it comes to privacy. Initially, I thought of privacy in terms of the intentionality of the disclosure of information, whether a person had intended to make it public or private. I realized that the concept of informational friction and privacy-by-design is that it’s not always ethical to collect, use, or share something that is technically accessible. Information is collected much more easily with technology, and risks have emerged that were not present before.<\/p>\n\n\n\n The Equifax case also taught me that people can be impacted by cybersecurity decisions even if they don’t have any control over the decisions. Individuals do not have the option of opting out of having information available to a credit reporting agency. This got me thinking about cybersecurity not just as a technical requirement for a company, but also as a responsibility towards others.<\/p>\n\n\n\n My future self should remember that personal information is personal information and that protecting it is a responsibility, not another technical task.<\/p>\n\n\n\n I think the case of Bill Sourour was one of the biggest that I’ve thought about during this course. Sourour was doing exactly what his boss told him to do, but the system he was assisting with was wrong. Prior to this course I may have believed that an employee’s primary duty was to get the job done. I realised that professional ethics and contractarianism were discussed and that professionals have responsibilities other than just obeying orders.<\/p>\n\n\n\n A cybersecurity expert may possess unique expertise that managers, customers, or the general public do not. This can make them more aware of potential hazards than other people. That doesn’t always relieve them of personal responsibility, which is why it’s important not to say, “I was just doing my job”. The whistleblower cases also taught me that it is not a crime to challenge an organization, but not a crime to be loyal to it. In some cases, it is a sign of being loyal to the bigger picture of an organization to raise concerns.<\/p>\n\n\n\n My future self should remember that just because you follow instructions doesn’t mean it is sufficient. When I see that technology is potentially harmful to people, I must question it and speak out.<\/p>\n\n\n\n The Israel-Iran cyberconflict and Facebook’s involvement in information warfare altered my perspective of what can be achieved with a cyberattack. I was primarily thinking of cyberwarfare in terms of an attack on military systems or the stealing of information. The cases demonstrated cyber operations can impact hospitals, fuel systems, transportation, elections and public opinion. The impact of cybersecurity decisions is therefore greater than the computer systems being attacked.<\/p>\n\n\n\n Prier also explained that information can be a weapon in itself with respect to social media. Facebook didn’t need to fabricate fake content for its algorithms to be a part of information warfare. Its systems have the potential to amplify information produced by other actors. Likewise, the Israel-Iran situation showed that an attack on infrastructure can have repercussions for civilians who had no direct involvement in the conflict.<\/p>\n\n\n\n My future self should remember to consider the possibility of a cyber operation beyond just being technically feasible. I should also think of who might be affected, whether the action is justified and what might happen as a result.<\/p>\n\n\n\n This course has given me a new perspective on cyber security, it is not only a technical field but also a field with a great deal of ethical responsibility. Through privacy, professional responsibility and cyberconflict, I learned that technology can impact the freedom, safety and trust of people. I think these lessons will be applicable in my future career in cyber security as decisions made in the technical realm can have repercussions beyond the technical itself. Being good at cybersecurity should not just mean knowing how to protect and operate technology. It should also mean understanding how and when that technology should be used responsibly.<\/p>\n\n\n\n