The Interplay of Law and Ethics in Information Security Management

This report delves into the critical intersection of law and ethics within information security, emphasizing their importance in safeguarding organizational assets and sensitive data. It begins by defining the concepts of law and ethics in the context of information security, highlighting the need for a ro...Read More

Running head: LAW AND ETHICS IN INFORMATION SECURITY 1
LAW AND ETHICS IN INFORMATION SECURITY
Student
Tutor
Institutional Affiliation
Date

LAW AND ETHICS IN INFORMATION SECURITY 2
Copyright
This document should not be reproduced or transformed in any form nor should it be stored or
retrieved by any means without authority from the author. This document will only be availed for
reference in school library or in any other library and copies may be produced as long as the
users are cognizant of the copyright.
2

LAW AND ETHICS IN INFORMATION SECURITY 3
Abstract
Information system security is becoming increasingly important in any organization.
Information security involves protection of information system assets from frauds. Technical
security management approaches are not enough for a robust security system. Due to the fact that
human being is one of the core factor in any system, they need rules that govern their operation
within the organization for a complete system security. It is therefore essential to set up law and
ethics in order to achieve a better information system security. This document has explored legal
and ethical conduct for a robust system security. In doing so, the document first explore law and
ethics as far as information system security is concerned, the document further explore the
meaning of information security and later examine some common ethical information security
issues. Afterwards, the paper explore various views of ethics in information security then
followed by ethical framework of a robust IT security as well as enforcement of ethical rules in
an organization.
3

LAW AND ETHICS IN INFORMATION SECURITY 4
Table of Contents
Copyright........................................................................................................................................2
Abstract..........................................................................................................................................3
Table of Contents...........................................................................................................................4
Law and Ethics in Information Security.....................................................................................5
Laws and ethics..............................................................................................................................5
Information security......................................................................................................................6
Ethical information security issues..............................................................................................7
Hacking.......................................................................................................................................7
Privacy breach............................................................................................................................7
Various perspectives of ethics in information security..............................................................7
Ethical framework for establishing a robust information security...........................................8
Enforcing ethical rules in organization........................................................................................9
Establishment of code of codes of conduct..................................................................................9
Training for awareness................................................................................................................10
Results and discussion.................................................................................................................11
4

LAW AND ETHICS IN INFORMATION SECURITY 5
Law and Ethics in Information Security
Comprehending the scope of a company’s legal and ethical responsibilities is essential for
a prospective Information Technology IT security professional. IT security personnel therefore
plays a critical role in any association through management of liability for security risks and
privacy. In the current generation, laws are authorized in common courts, where substantial
harms can be granted to offended parties who bring suits against associations. In certain
occasions, these harms are seen to be an impediment.
In order to reduce liability and risks from digital and bodily risks, and to decrease all
misfortunes from a lawful pastime, the information security specialists must altogether realize
the modern-day valid situation, stay current with the present day with legal laws and ethics, and
watch for new and developing troubles (Lloyd, 2017). By means of training the management and
workers of an association on their lawful and ethical commitments and the suitable usage of
information technology and data security, information security professionals can help preserve
an association focused on its important goals.
Laws and ethics
Before we dive into this critical aspect of information technology, it is essential to
explore the meaning of Law. Laws involve rules that mandate or disallow certain conducts; they
may be drawn from morals, which symbolize socially adequate practices (solove & schwartz,
2014). Ethics depend upon social issues: the constant good dispositions or traditions of a specific
collecting. A few ethical gauges are all-inclusive. As an instance, murder, housebreaking, attack,
and unlawful conflagration are sports that go astray from ethical and legitimate codes
everywhere in the globe.
5

LAW AND ETHICS IN INFORMATION SECURITY 6
Laws refer to the principles that everybody must oblige to abide by. In the event that they
don't pursue, they will be rebuffed. Which is not the situation as far as ethics is concerned;
according to ethics, all people have their very personal will (matwyshyn, cui, keromytis & stolfo,
2010). They decide to follow or not follow the code of morals. It therefore depends on an ethical
choice, several individuals concur upon ethical practices yet a few can differ as far as the
practices are concerned.
Morals, on the other hand, can be seen from various methodologies. These methodologies
are consequentialism and deontological. Consequentialism asserts that if activities have terrible
outcomes they're awful all things taken into consideration. Deontological strategies don't think
that manner. Instead, they assume that activities of individuals have neither unconceivable nor
worthless results they have laws freed from their sports.
The fogginess of morals additionally exist in someone's thoughts however with the help
of the laws and pointers security and health can be finished. In a digital world, law and ethics
cooperate to shape a security layer (Adams, 2010). Ethics can apply where the law cannot be
applied.
Information security
The fast pacing technology has made many organizations to adopt information system
where they store their sensitive data. Additionally, the current technology has made the
organizations to exchange sensitive information on a daily basis. Security issues may arise in the
process, therefore, organizations are concerned about information system security. Information
security is therefore essential in any organization as it protects privacy and confidentiality as well
as availability of the organization’s IT assets (Hableel, Byon & Beak, 2013). Technical
6

LAW AND ETHICS IN INFORMATION SECURITY 7
information system security technique is not enough to ensure a robust cyber security, other
measures must be put into place alongside the technical security system. In order for an
organization to develop a solid information system security, legal and ethical measures must be
put into consideration.
Associations rely on employees and technology to run its activities. Even with a top-
notch information system, there must always be personnel who operate the system. These
personnel will always need to ethics and code of conduct (Weber, 2010). Without these, the
information system will be vulnerable to cyber-threats. So individuals are essential in ensuring a
solid information security in any system.
Ethical information security issues
Hacking
Hacking involves gaining unauthorized access to information system for malicious
reasons. This may lead to loss of the organization’s sensitive information which may further
impact the image of the organization.
Privacy breach
Privacy does not only involve sensitive data but also involve relationships and private
belongings. Ethical problems involving privacy such as internet and personal privacy among
others arise in many occasions.
Various perspectives of ethics in information security
Ethics in IT security can be viewed from various perspectives. Different models of
information security are proposed by researchers. According to Whitman, Mattord, Mackey, &
7

LAW AND ETHICS IN INFORMATION SECURITY 8
Green (2012) IT security level can not only consist of a technical layer, it instead consist of
technological, technical, legal, organizational, ecological and social levels.
Notwithstanding these dimensions Whitman et al. (2012) recommends moral degree must be
incorporated into data security. The analyst likewise proposes that morals is a so vast inquiry that
engineers, clients and framework administrators can't answer independently. Whole people group
should respond to this inquiry by talking about together. So Whitman et al. (2012) imply that
morals should traverse a whole network and moral principles ought to be set up with a blend of
people from various territories. Solove & Schwartz (2014) proposes another ethical view of
information security. The researchers stated many ethical issues, they also expound that IT
security is threatened if these issues are occur in information system. The issues include:
 Information system has a control gap which get wider with the advent of technology. It is
predicted that the control gap can lead to problems to information security.
 The information system is becoming larger nowadays thus it is getting tougher to manage
with the technological machines alone. It is therefore imperative to develop individual
control mechanism.
 Ethics needs to be observed by individuals from various expertise as well as individuals
from other communities apart from the information technology society.
Failure to take the above issues into account, there can be a threat to information security
(Solove & Schwartz, 2014). It can therefore be noted that IT security can only be achieved by
considering the ethics as well as ethical framework of information security.
8

LAW AND ETHICS IN INFORMATION SECURITY 9
Ethical framework for establishing a robust information security
Numerous scientists expressed that data security is missing without ethical ideas. So as to
set up superior security, they proposed structures that incorporate moral standards. These
structures exist in numerous data situations like biomedical, e-banking and wellbeing and so on.
Model structures will be examined in this part to underscore the significance of moral standards
in data security.
Matwyshyn et al. (2010) Discusses extortion (phishing) in e-banking administrations.
They bring up a few dangers, vulnerabilities, episodes and effect of dangers on e-banking
administrations. Analysts recommended ethical principles and pieces of training on customers
and bank faculty to defeat cheats in e-banking administrations. They additionally expressed that
Public talk on episodes will create mindfulness and makes security conduct among e-banking
administration clients. Aliyu et al. (2010) built up a code of morals for wellbeing data experts.
He talked about a few issues in wellbeing informatics area and proposed a code of morals for a
few data security issues. He proposed that notwithstanding specialized security layer in a
wellbeing data framework there must be a moral layer that ensures protection of patients (Guo,
2013). He made this moral layer on wellbeing data experts.
Enforcing ethical rules in organization
Enforcing ethical rules in organization plays a critical role in information security. Giving
organization personnel ethical rules to follow and awareness to ethics will establish a robust
information security layer for the organization (Aliyu, Abdallah, Lasisi, Diyar & Zeki, 2010).
This can be achieved in two ways including establishment of code of conduct and training so
individuals be aware of ethics and security.
9

LAW AND ETHICS IN INFORMATION SECURITY 10
Establishment of code of codes of conduct
Nowadays many organizations and communities develop Code of conduct for its
contributors to follow. Without the improvement of these codes, data protection could have gaps
due to legal guidelines couldn’t fill a few gaps while ethics can do.
The ethical conduct guides people while interfacing with a data framework. Code of
morals is connected to the majority of the individuals in a data frame including framework
chairmen, engineers, clients, and security experts. Rather than applying a general code of morals,
associations can build up their own code of behaviors. Notably, this can turn out to be best in
light of the fact that to target and fill explicit holes in data security, explicit moral codes are
essentials. Be that as it may, so as to influence clients to withstand code of morals and to a
standard, there is a requirement for a community-oriented exertion. Mindfulness preparing builds
up this cooperative exertion.
Training for awareness
Training for security awareness is a critical aspect in establishment of a robust for a
robust security to be set in any information system, there must be a training to ensure awareness
of ethical conducts of information technology. Awareness is a broad term encompassing threats,
ethics and security incidence as well as how to deal with them.
The training must include pertinent security and ethical behavior to all employees in an
organization for full compliance to cyber security policies. Various research focus on the
awareness training as well as its importance in information security. Matwyshyn, Cui,
Keromytis, & Stolfo (2010) presents a study examining security as well as ethical behavior
which was conducted among students. The creators directed a few examinations among
10

LAW AND ETHICS IN INFORMATION SECURITY 11
understudies to discover that is mindfulness really influences security. The trials demonstrated
that the mindfulness preparing made a soul of security among understudies. In view of security
mindfulness training and morals courses, understudies are more mindful of security concerns and
morals than the student who does not train (Brooks, 2010; Elliott, 2010; Ruighaver, Maynard &
Warren, 2010). From the study, it can be noted that training and awareness in reality can
influence the security conduct of people. Likewise, they are critical in making moral guidelines
powerful in the network. Since this preparation additionally gives a still, small voice of morals to
people and as we would see it is critical to set up data security.
Results and discussion
Ethics assume significant responsibilities in our lives and furthermore in digital
innovation space. Morals fill holes in a data framework that laws can't most likely fill (Mamic,
2017). In this document, the significance of moral standards in IT security has been studied.
Diverse ethical points of view in writing are assessed to indicate how moral layer can be based
on the security layer (Guo, 2013). Likewise in this paper, to give a shred of strong evidence that
morals complete data security, a few moral systems are assessed. At long last, techniques to
make its guidelines successful in a network have been studied. A few inspected considers
demonstrated that mindfulness preparing and code of behaviors are compelling.
Numerous expert organizations have put into place law and ethics that individuals are required to
adhere to. Those moral behavior policies can definitely have an effect on individuals' judgment
with admire to using computers. It is unlucky that several agencies don't urge their
representatives to join these expert associations. However, mployees who've earned some
accreditation can be dissuaded from moral slips with the aid of the risk of loss of accreditation or
affirmation due to an infringement of implicit policies. Lack of confirmation or accreditation can
11

LAW AND ETHICS IN INFORMATION SECURITY 12
appreciably decrease splendor and obtaining strength. It is the responsibility of protection experts
to behave morally and as in line with the procedures and strategies in their bosses, their
professional associations, and the legal guidelines of society (li, Owen, & Simakova, 2015). It is,
therefore, the responsibility of the organization to create and enforce its guidelines and policies
concerning legal guidelines and ethics.
12

LAW AND ETHICS IN INFORMATION SECURITY 13
References
Hableel, E., Byon, Y. J., & Beak, J. (2013, November). Public key infrastructure for UAE: A
case study. In Proceedings of the 6th International Conference on Security of
Information and Networks (pp. 336-340). ACM.
Adams, S. A. (2010). Revisiting the online health information reliability debate in the wake of
“web 2.0”: an inter-disciplinary literature and website review. International journal of
medical informatics, 79(6), 391-400.
Aliyu, M., Abdallah, N. A., Lasisi, N. A., Diyar, D., & Zeki, A. M. (2010, December). Computer
security and ethics awareness among IIUM students: An empirical study. In Proceeding
of the 3rd International Conference on Information and Communication Technology for
the Moslem World (ICT4M) 2010 (pp. A52-A56). IEEE.
Aliyu, M., Abdallah, N. A., Lasisi, N. A., Diyar, D., & Zeki, A. M. (2010, December).
Computer security and ethics awareness among IIUM students: An empirical study.
In Proceeding of the 3rd International Conference on Information and Communication
Technology for the Moslem World (ICT4M) 2010 (pp. A52-A56). IEEE.
Brooks, D. J. (2010). What is security: Definition through knowledge categorization. Security
Journal, 23(3), 225-239.
Elliott, C. (2010). Botnets: To what extent are they a threat to information security?. Information
security technical report, 15(3), 79-103.
13

LAW AND ETHICS IN INFORMATION SECURITY 14
Guo, K. H. (2013). Security-related behavior in using information systems in the workplace: A
review and synthesis. Computers & Security, 32, 242-251.
Li, F., Owen, R., & Simakova, E. (2015). Framing responsible innovation in synthetic biology:
The need for a critical discourse analysis approach. Journal of Responsible
Innovation, 2(1), 104-108.
Lloyd, I. (2017). Information technology law. Oxford University Press.
Mamic, I. (2017). Implementing codes of conduct: How businesses manage social performance
in global supply chains. Routledge.
Matwyshyn, A. M., Cui, A., Keromytis, A. D., & Stolfo, S. J. (2010). Ethics in security
vulnerability research. IEEE Security & Privacy, 8(2), 67-72.
Matwyshyn, A. M., Cui, A., Keromytis, A. D., & Stolfo, S. J. (2010). Ethics in security
vulnerability research. IEEE Security & Privacy, 8(2), 67-72.
Ruighaver, A. B., Maynard, S. B., & Warren, M. (2010). Ethical decision making: Improving the
quality of acceptable use policies. Computers & Security, 29(7), 731-736.
Solove, D. J., & Schwartz, P. (2014). Information privacy law. Wolters Kluwer Law & Business.
Weber, R. H. (2010). Internet of Things–New security and privacy challenges. Computer law &
security review, 26(1), 23-30.
Whitman, M. E., Mattord, H. J., Mackey, D., & Green, A. (2012). Guide to network security.
Cengage Learning.
14