An extremely interesting article has been published on the Australian commission into banking practices. We tend to be directed to banking literature for a number of aspects of risk management, but this says some really interesting things about ethics.
Once upon a time, Number Two Daughter worked for a leasing company. I think she was still working for them when she opined that the further you got from selling something specific and real, the more dangerous the ethical quagmire became, and that selling leasing was about as close as you could come to selling nothing.
Here in Canada we've just had a round of investigations into the banks and their sales practices. Our banks have similar characteristics of those described: big and monolithic.
The Daughters, and therefore, we, know a number of people who work for the banks. I was amused by the "they'll employ anyone" comment in the article, because, although I assume it's true, it's sort of a Hotel California situation. You can sign on any time you like, but you can never leave. Once you are in the bank, your work, your social life, sometimes even your relationships and marriage are kind of confined to the bank.
Various parties and social functions are arranged by the bank and, while not exactly put down on your timesheet, your job performance reflects whether you attend a sufficient number. It's hard to do that and maintain a separate social life as well. And, once in, it can be hard on "non-bank" relationships, so it's easier to marry someone already in the cult sorry, bank, who understands the requirements.
There can be good reasons for this. Banks, as much and possibly more than most companies, are alert to security and insider risks. Having close relationships with all employees is one way to address these issues.
But the various aspects of groupthink (and, while the article raises a number of factors and then seems to note groupthink as a separate one, while I tend to think of all those factors as characteristics of groupthink) can, as the article notes, lead to failures in critical thinking and, in particular, failures in ethical consideration.
As noted in one of the quotes, "Unfortunately, I don't think I can control away inappropriate advice in every instance. Some people, the minority, may, for whatever reason, be dishonest, put their own interest before others. I can't control that away."
It's extremely hard (probably impossible) to "control" for insider risk. It's equally hard to "control" for ethics. We are supposed to adhere to our code of ethics. But, as I have frequently noted to my seminars, when trying to deal with the ethics area, there are some CISSPs who, after I've shaken hands with them, I count my fingers.
I hope you don't just read this and think that it's a good thing you don't work for a bank. (Unless you work for a bank.) Any large organization can develop the same characteristics. That includes the companies you work for. It also includes large bodies such as ISC2, and even just the international community of certificate holders.
The price of ethical behaviour is constant vigilance ...
............
Other posts: https://community.isc2.org/t5/forums/recentpostspage/user-id/1324864413
This message may or may not be governed by the terms of
http://www.noticebored.com/html/cisspforumfaq.html#Friday or
https://blogs.securiteam.com/index.php/archives/1468
