A Survey of Ethical Agreements in Information Security Courses

ABSTRACT

Existing ethical agreements, as applicable in the teaching of information security courses, typically spell out rules on what students should and should not do. The main problem is that the question of what students should or should not do is not a settled issue, because personal stances on questions of morality and ethics fundamentally influence the ethical recommendations that teachers present to their students. In light of the growing level of malice in the computing domain, experts have highlighted the importance of information security ethics by debating the need for a standard code of ethics for information security. Arguably, differences in ethical stance, with the effect of divergent ethical agreements, will not efficiently serve the purpose of effective universal application of ethics in the field of information security education. Examining current ethical policies in information security courses can provide insight about the prevailing ethics within the information security community. Moreover, understanding what the prevailing philosophies on ethics are within the community, in terms of how they actually diverge or converge, will present a good projection of how a standard policy on ethics may be feasibly applicable in a future regulatory environment. This way, we may be able to forecast the nature of ethical norms that future professionals will accept or allow to be imposed on them. Therefore, in our survey, we analyze ethical agreements on information security courses to identify the nature of existing agreements. We determine the commonalities of these agreements and derive an ethical policy prototype that includes the common elements of 329 ethical policies.

References

1. ACM. Code of Ethics - Association for Computing Machinery. http://www.acm.org/about/code-of-ethics.
2. J. Aycock, E. Buchanan, S. Dexter, and D. Dittrich. Human subjects, agents, or bots: Current issues in ethics and computer security research. In Financial Cryptography and Data Security, pages 138--145. Springer, 2012.
3. freesummarizer.com. Free Summarizer. http://freesummarizer.com/#summarizecontainer.
4. S. J. Greenwald, B. D. Snow, R. Ford, and R. Thieme. Towards an ethical code for information security? In Proceedings of the 2008 workshop on New security paradigms, pages 75--87. ACM, 2009.
5. C. E. Harris. Applying moral theories. Wadsworth Publishing Company, 1997.
6. IEEE. IEEE Code of Ethics. http://www.ieee.org/about/corporate/governance/p7-8.html.
7. G. Ledin Jr. The growing harm of not teaching malware. Communications of the ACM, 54(2):32--34, 2011.
8. J. P. Sullins. A case study in malware research ethics education: When teaching bad is good. In Security and Privacy Workshops (SPW), 2014 IEEE, pages 1--4. IEEE, 2014.
9. UofC. University of Calgary : K.1 Statement of Intellectual Honesty. http://www.ucalgary.ca/honesty/.
10. J. Vijayan. Undergrad suspected in massive Univ. of Nebraska breach, 2012.

Index Terms

• General and reference

  • Document types

    • Surveys and overviews

• Security and privacy

  • Human and societal aspects of security and privacy

    • Privacy protections

    • Social aspects of security and privacy

• Social and professional topics

  • Computing / technology policy

  • Professional topics

    • Computing education

      • Computing education programs

        • Computer science education

        • Information systems education

        • Information technology education