topic Re: Ethical principals in Welcome

Ethical principals

rslade — Mon, 09 Oct 2023 08:52:49 GMT

Over on the CISSPforum, we are having a little discussion about codes of ethics.

Somebody noticed that:

> Yes, that's the writing on the site, but shouldn't it be "competent
> service to principals"?

And, good grief, he's absolutely right.

In a sense, the Website is correct: we should competently serve the moral principles of our profession. (Even if it sometimes means we disappoint our principal employers, since the society and ethics canons come first 🙂

Re: Ethical principals

Shannon — Wed, 01 Aug 2018 03:59:41 GMT

Yes, there will often be a difference between what's expected of us as CISSPs and as employees, & the degree of the variance may be unpredictable.

Imagine adding a disclaimer to one's CV or cover letter, something like 'Please note that as a CISSP, I am committed to following the (ISC)2 Code of Ethics at all times.'

Re: Ethical principals

denbesten — Wed, 01 Aug 2018 17:43:40 GMT

@SamanthaO_isc2, tagging you so that you see this message. If you could forward it to the (ISC)² web admin, I would appreciate it.

Re: Ethical principals

j_M007 — Wed, 01 Aug 2018 21:27:59 GMT

<humor>
Do principals have principles? 
Are principals principled? 
We have the principal principles set forth powerfully in the Canon (or is that cannon?) 
Hopefully loose cannons will recognize the Canon and respect its principles!
</humor>

It appears ambiguities lurk deeply in the English lexicon; and what of Ethics?

Ambiguities lurk there, too. What may seem deontologically unethical to one person may be perfectly acceptable to someone else.

For a Hacktivist, for instance, it may seem perfectly acceptable to use LOIC against his sociopolitical targets. However, those who enforce legislation would likely take a dim view of that action and proffer charges if they catch the perpetrator.

Moreover, would it be ethical or unethical for a CISSP in the employ of an Agency, acting under authority, to use knowledge to degrade the infrastructure of an adversary, whether non-state or state? After all, we are to “Protect society, the common good, necessary public trust and confidence, and the infrastructure”; and to “Act honorably, honestly, justly, responsibly, and legally.”

Quite complex. An excellent question, Rob!

Re: Ethical principals ((ISC)Â² Community Subscription Update)

rslade — Wed, 01 Aug 2018 22:30:45 GMT

> j_M007 (Contributor I) posted a new reply in Welcome on 08-01-2018 05:27 PM in

> It appears ambiguities lurk deeply in the English lexicon; and
> what of Ethics? Ambiguities lurk there, too. What may seem deontologically
> unethical to one person may be perfectly acceptable to someone else.

Usually teleologically 🙂

> Moreover, would it be ethical or unethical for a CISSP in the
> employ of an Agency, acting under authority, to use knowledge to degrade the
> infrastructure of an adversary, whether non-state or state? After all, we are to
> "Protect society, the common good, necessary public trust and confidence, and
> the infrastructure"

Actually, I am currently working (with a colleague) on a presentation on exactly
that issue: the ethics of active defence. (I'm pretty sure I have a solid argument
that yes, in some cases you can degrade the infrastructure of an adversary, and
argue that it is for the good of society.)

====================== (quote inserted randomly by Pegasus Mailer)
rslade@vcn.bc.ca slade@victoria.tc.ca rslade@computercrime.org
Every old idea will be proposed again with a different name and
a different presentation, regardless of whether it works.
- RFC 1925 #11
victoria.tc.ca/techrev/rms.htm http://www.infosecbc.org/links
http://blogs.securiteam.com/index.php/archives/author/p1/
http://twitter.com/rslade

Re: Ethical principals ((ISC)Â² Community Subscription Update)

j_M007 — Wed, 01 Aug 2018 23:07:16 GMT

"Actually, I am currently working (with a colleague) on a presentation on exactly that issue: the ethics of active defence. (I'm pretty sure I have a solid argument that yes, in some cases you can degrade the infrastructure of an adversary, and argue that it is for the good of society.)"

By the same token, the adversary could use the same argument, notions like "society" and "good" are very broad ranging.

I suppose the test is that of the legal challenge - if the adversary's society is relying on electricity to power its hospitals, as well as its centrifuges for more nefarious purposes, then the principle of "Do No Harm (or As Little Harm As Possible)" or would have to be applied -- launch DDoS against the installation, degrade its capacities, but spare the grid to which the hospital is attached. Easier said than done, though.

So when the inevitable discussions arrive, "the Degrader" can argue in an international tribunal that he exercised due diligence and due care.

Re: Ethical principals

SamanthaO_isc2 — Thu, 02 Aug 2018 12:25:31 GMT

Thank you for tagging me @denbesten. Apologies for the delay here, I was out of the office yesterday. I will forward this along to our team.

Re: Ethical principals

SamanthaO_isc2 — Thu, 02 Aug 2018 20:52:49 GMT

Just a quick update - this is now fixed. Thank you for letting us know!

Re: Ethical principals ((ISC)Â² Community Subscription Update)

DAlexander — Fri, 03 Aug 2018 06:26:37 GMT

This is an interesting topic but hardly a new one. The ethics philosophy has been discussed throughout history by all sorts of “deep thinkers.” The only true novelty of this discussion is that we are now applying it to the “cyber” world but otherwise, it’s a one-for-one swap of the same conversation.

I think, at its most basic form, ethics defines what is good for individuals AND society. To be more specific, it is what determines right or wrong as agreed upon by the majority of the collective group of people that are impacted – stakeholders if you will.

The hacktivist example is clearly unethical behavior no matter how strongly that one individual’s, or group’s, feelings are. Why? Because there is legislation on the record that states it is illegal (aka wrong). Those laws have been proposed through an accepted process, negotiated by representatives elected by the people (usually), and ratified for the good of the society. There is also a legal method to challenge and change laws that doesn’t include “taking the law into your own hands.”

Problems arise when individuals or small groups, whose views are often borne from limited personal experience, bias, and a narrow view of the world, think they are somehow smarter or better suited to decide what is right and wrong than the larger collective or those in a position to see the big picture.

I would argue that ethics is only complex if you choose to make it so. Do what is right and legal in the society you live, respect others, don’t take what’s not yours, and live by the Golden Rule. Of course, there are questionable situations but if you know the law then at least there is a framework to guide your decisions.

Re: Ethical principals

rslade — Fri, 03 Aug 2018 16:17:13 GMT

> DAlexander (Newcomer III) posted a new reply in Welcome on 08-03-2018 02:26 AM

> I think, at its most basic form, ethics
> defines what is good for individuals AND society. To be more specific, it is
> what determines right or wrong as agreed upon by the majority of the collective
> group of people that are impacted stakeholders if you will.

My stakeholders, right or wrong!

> Because there is legislation on
> the record that states it is illegal (aka wrong).

Frequently the attitude of LE-only groups. "Orders! I vas only following orders!"

> Those laws have been proposed through an accepted process, negotiated by
> representatives elected by the people (usually), and ratified for the good of
> the society.

The tyranny of the majority 🙂

> I would argue that ethics is only complex if
> you choose to make it so.

"There is always a well-known solution to every human problem — neat,
plausible, and wrong."

"The Divine Afflatus," H. L. Mencken

====================== (quote inserted randomly by Pegasus Mailer)
rslade@vcn.bc.ca slade@victoria.tc.ca rslade@computercrime.org
In answer to the question of why it happened, I offer the modest
proposal that our Universe is simply one of those things which
happen from time to time. - Edward P. Tryon
victoria.tc.ca/techrev/rms.htm http://www.infosecbc.org/links
http://blogs.securiteam.com/index.php/archives/author/p1/
http://twitter.com/rslade

Re: Ethical principals ((ISC)Â² Community Subscription Update)

j_M007 — Fri, 03 Aug 2018 19:09:41 GMT

Excellent points, DAlexander. I think you're right about the study and development of Ethics or Moral Philosophy.

Our understanding of how to be in society, our laws (criminal, civil, administrative), our business interactions are all founded on ethical principles.

As I am reading this fascinating discussion, I am pleased that it is ironically in the Welcome section! Ethical behavior is fundamental to a well functioning society.

I am also reminded of the discussion Crito had with Socrates before his execution. Crito is concerned about what people will think of him if he lets his friend perish. Socrates is concerned only about the laws and the ethics of breaking out of jail and fleeing Athens. He has made his peace with himself and has chosen to accept his fate and not to offend or disrespect the Laws.

So you're also right when you talk about "complexifying" matters.

On the other hand, there have been clearly unjust laws in the past that have caused people to revolt, remember why the American Revolution started? It was, among other factors, caused by "No Taxation with Representation" and other issues that were enacted by the British Parliament against those who lived in the 13 colonies. So many taxes, so little representation.

These are great issues to ponder and to discuss and to apply to our lives as Information Security professionals.

They are at the base of maintaining the Integrity of the profession.

Re: Ethical principals

Beads — Fri, 03 Aug 2018 20:23:06 GMT

Its late on a Friday afternoon so forgive me.

Though I agree with the thrust of the post, I do have to ask if this is policy statement? Perhaps should consider this to be a working standard, possibly a procedure or simply guidance on behalf of the ISC(2)?

Please advise,

BEads (Brent)

Re: Ethical principals

j_M007 — Fri, 03 Aug 2018 22:35:19 GMT

A fascinating discussion, and an important one to be sure. Best.

Re: Ethical principals

DAlexander — Mon, 06 Aug 2018 08:33:18 GMT

@rslade, a common tactic of Internet and media trolls is to selectively quote parts of a discussion and attempt to counter with seemingly prophetic one-liners that lack substance. Rather than trying to be clever, could you enlighten us with your understanding of ethics? I am also especially curious to know what you suggest would be a better system to replace nations of laws (or as you put it, tyrannies of the majority).

Finally, I recommend that you do a little background research on things before you cut and paste from your favorite book-o-quotes. Besides the H.L Mencken gem you selected when responding to my post, he has others that I wonder if you agree with. For example, he once wrote, "It is impossible to talk anything resembling discretion or judgement into a colored woman" when talking about his black maid. He followed that with, "They are all essentially child-like, and even hard experience does not teach them anything." There are several other examples of his racist and anti-Semitic writing as well but I trust you can google that as well as anyone.

Re: Ethical principals

j_M007 — Tue, 07 Aug 2018 20:53:27 GMT

In reading the comments regarding our responsibilities both toward principals and principles, I am reminded of the Organisation for Economic Co-operation and Development 's (OECD) 2002 document : OECD Guidelines for the Security of Information Systems and Networks: Towards a Culture of Security: http://www.oecd.org/sti/ieconomy/15582260.pdf

Guidelines 4) Ethics and 5) Democracy ring particularly important today, in view of the actions of adversaries who wish to subvert nations' commercial and political institutions.

Regarding Ethics (4), here is what OECD had to say:

Participants should respect the legitimate interests of others.

Given the pervasiveness of information systems and networks in our
societies, participants need to recognise that their action or inaction may
harm others. Ethical conduct is therefore crucial and participants should
strive to develop and adopt best practices and to promote conduct that
recognises security needs and respects the legitimate interests of others.

Regarding Democracy (5), here is the OECD guideline:

The security of information systems and networks should be compatible with
essential values of a democratic society.

Security should be implemented in a manner consistent with the values
recognised by democratic societies including the freedom to exchange
thoughts and ideas, the free flow of information, the confidentiality of
information and communication, the appropriate protection of personal
information, openness and transparency.

As information security professionals it may also be well to take into consideration some of these principles as well and to understand that not everyone has the same desire for harmony as we do.

Re: Ethical principals

Dain — Thu, 09 Aug 2018 18:38:00 GMT

I find it extremely ironic that you have effectively called Rob a troll for pointing out to you that you have seemingly conflated what is "Right" and what is "Legal" into being the same general idea, an idea that often has, and still does, lead to average people acting horribly towards others under the auspices of "it was legal".

I fail to see how dropping a relevant, if pithy quote is trolling, as it quite effectively points out the issue with what you put forth, not to mention that, with a little research, brings one around to other writings of the author in question which clearly illustrate deeper issues with confusing RIGHT and LEGAL.

I think its especially ironic that your point regarding H.L Mencken's other writing ties back (tangentially at least) to a history (in the US) of LEGAL discrimination against various groups, which I'm fairly comfortable in saying was not RIGHT, tho it was certainly LEGAL.

Re: Ethical principals

DAlexander — Fri, 10 Aug 2018 04:46:39 GMT

@Dain, I see no irony at all because he didn’t point anything out…that was the point of my message evidenced by the words “lack substance.” Since you’ve raised your concerns however, let’s examine the Code of Ethics Canons that this very discussion was initiated on and maybe we can clear up your confusion. I want to highlight the first two in particular:

Protect society, the common good, necessary public trust and confidence, and the infrastructure.
Act honorably, honestly, justly, responsibly, and legally.

I believe it is appropriate to expect one to know the difference between right and wrong when protecting the common good. I will concede that there are instances when the line between right and wrong is a little less defined however, societal norms should help to guide our decisions. Societal norms are essentially the agreed-upon sets of rules that members of that society live by. They are not set in stone and commonly change from generation to generation. Acting legally is not so nebulous. In most developed, functioning societies, laws are documented and specific enough to define a clear line not to cross. When that is not sufficient, laws can be challenged either in court or through another legislative process to actually change them to better meet the needs of the common good. I want to emphasize that I am in no way implying that there are not exceptions to this and that some nations’ legal systems are woefully corrupt and ineffective.

I ask you to consider two terms, constraint and restraint. A constraint is something you cannot do such as commit bank fraud, steal from a retailer, slap your neighbor, conduct vigilante-style cyber attacks, etc. Laws are therefore, constraints. A restraint is something you must (or must not) do that is imposed upon you by either yourself, your boss, your God, or whoever you answer to. This is what I would categorize as ethics. In the context of being an information security professional, constraints should take precedence over restraints. We have responsibility to question and refuse to do anything that is illegal, period.

You raise the notion that people often act horribly towards each other because they believe it is legal to do so. Believe me, I am well aware of terrible human rights issues that happen in many regions of the world. I have been to several of them and witnessed the aftermath first-hand. I wonder though, are these atrocities happening because the law prevents the members of that society from treating each other with dignity and respect…or is it the lack of laws or enforcement of the laws that is allowing this? I’d argue it is the latter and that particular society is acting neither ethically nor legally…and that is wrong.

As for the quote, I am actually not surprised you’d be the one to defend it based on some of your previous posts (https://community.isc2.org/t5/Industry-News/Risk-management/m-p/10541#M953). No matter how clever something copied from the Internet may seem to some contributors, we should never glorify any individual that has a documented history of racism, sexism, or any other –ism.

Re: Ethical principals

Dain — Fri, 10 Aug 2018 16:31:35 GMT

I'm not really sure where the Risk discussion comes in, in terms of defending the quote (other than to say that yes, i firmly believe that thinking for oneself - regardless of what the law, religion, or society as a majority provides as moral guidelines is important - and that none of those things necessarily provides an objective measure of good/bad - not do I believe it is a binary analysis in most any but the simplest of intellectual exercises.

I thought the quote was remarkably apt, for a number of reasons, not least of which was the that it came from a closeted bigot, who lived in a time when such beliefs were accepted, if not outright encouraged, by society, and the laws of the US. So to us he is some what abhorrent, and yet at the time he fit the guidelines of morality and legality (at least as far as the bigotry goes, some of his political views were pretty obnoxious anyway you look at it)

the point - I believe - was that allowing oneself to subscribe to such guidelines without carefully evaluating the baselines those constraints and restraints originated with (historical, religious, legal, racial, whatever) leaves one open to the belief that they are acting morally, ethically, honorably as measured against a very flawed stick. Not to mention an easy way to defend immoral, unethical, and less than honorable behavior.

And yes, i had to look up the quote, and the author, and it made me think about what i think Rob was trying to say. Would I have learned as much if I didn't have to look it up? hard to say

Re: Ethical principals

Early_Adopter — Fri, 07 Sep 2018 19:38:19 GMT

@notetaker

Hi Derek,

As noted by other respondents ISC2 really doesn’t have such sharp business practices.

I can attest to this as my college and I signed up to attend congress this year. He couldn’t attend so tried to cancel, but had gone outside the cancelation timeframe for the conference. ISC2 did not have to refund his attendance fee but did, he is neither certified by nor an accossiate of ISC2 and no one interceded on his behalf.

Well done for passing the HCISSP exam, however ISC2 will have to verify your stated experience, if they can’t do that to satisfaction, then it’s not going to be possible to certify you.

My advice would be to delete your posts that are defamatory to ISC2 and surely counterproductive to your cause, calm down and then reach out to the folks you have already been talking to apologise and see how to move forward.

ISC2 really doesn’t want your proprietary information, but it rests upon the candidate to meet the requiments for certification, they would try to help as much as is permissible, but you’ll either meet the experience requirement or not. It may be that accosiate of ISC2 is going to work out better until such time as you can reliably prove your experience.

Best regards,

Michael