Cybersecurity

Ethics, Legal, Risks, and Policies

Ishaani Priyadarshini, Chase Cotton

• Publisher: Apple Academic Press
• Year: 2022
• eBook ISBN: 9781000406917
• Edition: 1
• Topic: Business
• Subtopic: Management
• Index: Business

This book is the first of its kind to introduce the integration of ethics, laws, risks, and policies in cyberspace. The book provides understanding of the ethical and legal aspects of cyberspace along with the risks involved. It also addresses current and proposed cyber policies, serving as a summary of the state of the art cyber laws in the United States. It also, importantly, incorporates various risk management and security strategies from a number of organizations.

Using easy-to-understand language and incorporating case studies, the authors begin with the consideration of ethics and law in cybersecurity and then go on to take into account risks and security policies. The section on risk covers identification, analysis, assessment, management, and remediation. The very important topic of cyber insurance is covered as well—its benefits, types, coverage, etc. The section on cybersecurity policy acquaints readers with the role of policies in cybersecurity and how they are being implemented by means of frameworks. The authors provide a policy overview followed by discussions of several popular cybersecurity frameworks, such as NIST, COBIT, PCI/DSS, ISO series, etc.

PART I Cybersecurity: Ethics and Legal

CHAPTER 1 Introduction to Cyberethics

In this chapter, we introduce the concept of cyberethics and its importance in cyberspace. We also present certain terms and their definitions. Several concepts have been explained in the form of illustrations followed by explanations in order to present the readers a better idea about the topics.

1.1 ETHICS IN CYBERSPACE AND CYBERSECURITY

The National Institute of Standards and Technology (NIST) defines cyberspace as the interconnection and association of networks of information technology (IT) infrastructures. The infrastructure comprises computer systems, internet, telecommunications networks, and embedded processors and controllers in critical industries [1].

1.1.1 DEFINITION 1.1: CYBERSPACE

In 1982, a science fiction writer by the name William Gibson coined the term ‘Cyberspace’ [2]. Cyberspace may be defined as the national environment in which communication over computer networks occurs. It is a computer network that integrates and incorporates a worldwide network of computer networks. These networks use the TCP/IP (transmission control protocol/ internet protocol) network protocols for facilitating data transmission and exchange.

While cyberspace takes into account the overall functioning of all these components, it also commands safety and reliability due to the huge amount of data traveling across cyberspace. This data may be highly sensitive. Data protection and integrity of computing assets that are a part of an organization’s network are critical. Hence, there is a need to defend the assets from any kind of cyber-attacks. Cybersecurity may be defined as the process of preventing any damage, followed by protecting, and restorating the computers, electronic communications services, wire communication, electronic communications systems, and electronic communication [3].

1.1.2 DEFINITION 1.2: CYBERSECURITY

Cybersecurity refers to the body of technologies, processes, and practices designed for the protection of networks, devices, programs, and data from attack, damage, or unauthorized access. It incorporates securing the networks, applications, information, and operations that take place over cyberspace.

These components may incorporate within themselves some information, and for securing these components and the data within it, it is mandatory to ensure its availability, integrity, authentication, confidentiality, and nonrepudiation which are basically the pillars of cybersecurity [14].

Figure 1.1 describes the pillars of cybersecurity which are essential for securing cyberspace. They are as follows:

1. Confidentiality: It refers to protecting the information from disclosure to unauthorized parties. It is associated with the protection of details which should be visible or accessible to people who have appropriate privileges.
2. Integrity: It is responsible for ensuring trustworthiness, accuracy, and completeness of the sensitive information. The main objective of integrity is to protect information from being altered by unauthorized or unintended parties and individuals.
3. Availability: It is responsible for ensuring that only authorized parties can access the information when at the time of need.
4. Authentication: It refers to the process of ensuring and confirming the identity of a user.
5. Non‑Repudiation: It can be used to ensure that a party involved in a communication cannot deny the authenticity of their signature on a document or the sending of a message that they originated.

FIGURE 1.1 Pillars of cybersecurity.

Over the last few decades, cyberspace has expanded tremendously and has influenced several other fields like healthcare, finance, technology, business, etc. As cyberspace got associated with these fields, the underlying risks of cybersecurity also made their way into these fields. The interaction of humans with cyberspace has also increased with the advancement of technology. This has also contributed a lot to the cybersecurity risks [15]. As people are connected to each other using such a substantial platform, a lot of activities take place over cyberspace that are morally wrong. Internet crimes have shown an upward trend in graphs over the last decade, indicating the number of crimes that have been increasing day by day [16]. A large chunk of crimes committed in cyberspace may be traced down to employees working within an organization. Sometimes these employees target their previous work places. Spam and phishing emails for ransomware infection are another form of cyber-attacks that are common. Much of these cybersecurity crimes can be attributed to a lack of end user cybersecurity training. The lack of end-user cybersecurity training can be traced down to few observation points:

• First, lack of proper cybersecurity ethics training may make the employee unaware of any breach of ethics in cyberspace. An employee may not realize if he/she has been victimized on the grounds of ethics.
• Second, the employee themselves may at some point of time do something that is ethically wrong.
• Third, due to the lack of cyberethics training, an employee may not know what is to be done in this situation, further deteriorating the situation.
• Second, the employee themselves may at some point of time do something that is ethically wrong.

Thus, there is a need to highlight the importance of cyberethics.

Cyberethics presents certain situations in the form of behavior as good or bad, and right or wrong. Cyberspace may be influenced by both people as well as technology. Cyberethics gives an overview of the situations and challenges that arise in the cyberspace due to people and technology. Cybersecurity ethics is a part of cyberethics. While cyberethics deals with computers and networks and programs and the people and organizations that use them, cybersecurity ethics is more concerned about the ethics associated with the practice of cybersecurity, usually what is done by the cyber professionals.

As we know, neither cybersecurity issues know any bound, nor does cyberspace. Thus, there are no physical borders when it comes to cyberspace. Although national and international laws exist, cyberspace is global. Therefore, ethics in cyberspace is also global as well as interconnected.

1.1.3 DEFINITION 1.3: CYBERETHICS

Cyberethics may be defined as the code of responsible behavior over cyberspace. Laws are the outcomes of Ethics. Ethics are principles that are responsible for guiding a person or society. They are created to decide what is good or bad, and what is right or wrong in a given situation. It is used for regulating a person’s conduct and also assists individuals in living better lives by considering basic moral rules and guidelines.

Thus, ethics promotes a sense of fairness and promotes acceptable behaviors. Ethical practices are useful for identifying what unacceptable behavior looks and feels like. Ethical behavior requires courage, i.e., say something if you see something that is morally wrong, and to stand up against what is morally wrong. Ethical behavior also requires humility, i.e., if you are ethically wrong, accept it because wrong decisions can be made by anyone.

The concept of Cyberethics is not confined, rather varies across many definitions. Wikipedia defines ‘cyberethics’ as the philosophic study of ethics for computers. It also highlights user behavior, what computers are programmed to do, and the effect of this on individuals and the society [4]. Further, Pusey and Sadera defined cyberethics as a set of “moral choices made by individuals using Internet-capable technologies and digital media [5]. Cyberethics is also referred to as a branch of applied ethics that explores the issues related to computer/information and communication technologies morally, legally, and socially. Sometimes it is also mentioned as Internet ethics, computer ethics, and information ethics. The expression “Internet ethics” is quite narrow as it is not enough to investigate the expanse of cyber-related ethical issues that are due to independent internet and networked computers. Therefore, there is a need to explore a new type of ethics which has emerged over the last few decades as a result of the creation of the Code of Computer Ethics. This new kind of ethics may have a binding effect on the professional, especially if the code is incorporated into work ethic and procedure. The Centre for Internet Security has its own definition of cyberethics which is, “the code of responsible behavior on the internet [6]. Thus, in general, cyber-ethics encourage the use of appropriate ethical behavior and acknowledge rights and responsibilities that are associated with online environments and digital media.

Ethics in cyberspace may be described in the following ways:

1. Cyberethics underpins the study of ethics pertaining to computers and networks;
2. Cyberethics also takes into account user behavior as well as what computers are programmed to do;
3. Cyberethics has its effects on individuals and society;
4. Cyberethics focuses on responsible behaviors on the internet;
5. Cyberethics deal with ethics applied to the Online Environment.

1.2 ETHICS, LAW, AND POLICY

As mentioned before, laws are the outcomes of ethics. It is interesting to observe that Cyber law is related to cyberethics. While cyberethics is concerned with providing foundations for ethical behavior in cyberspace, thereby reflecting the ethical standards of human civilization, Cyber law, on the other hand, as a discipline, deals with legislations that are passed in different countries. These legislations are capable of effectively providing sanction, validity, and enforceability to various principles concerning ethical behavior in cyberspace. Thus, Cyber law as a discipline, effectively strengthens the foundations of good ethical behavior. This is a requirement for cyberethics. Moreover, cyberethics can be significantly enhanced by deploying cyber legal frameworks, as the ethical principles on their own do not have any respective standing. Cyberethics only stipulates moral values but until ethical standards concerning ethical behavior in cyberspace are sufficiently backed by appropriate legal provisions and sanctions, they rarely get complete enforceability. Cyber Security Policy is a formal set of rules and must be followed by people who are given access to company technology and information assets. The Cyber Security Policy serves several purposes, like defining what technology and information assets must be protected. It is also responsible for identifying any underlying threats to the assets. The Cyber Security Policy also describes the responsibilities and privileges that users have.

There is an interconnection between Ethics, Law, and Policy in the Cyberspace. While Ethics account for code of conduct and responsible behavior that should be followed in cyberspace, Cyber laws are legislations that focus on the acceptable behavioral use of technology in cyberspace and must be followed. Policies are made to achieve some goals and are therefore usually followed (Figure 1.2).

1.3 PRIVACY AND SECURITY

As the world progresses towards hyperconnectivity, the issue of security versus privacy remains one of the fiercely contested global issues. However, privacy, and security are comparable. Privacy compares to any rights one has to control the personal information and how it is used. Security, on the other hand, considers how personal information is protected. Privacy and Security often overlap in the real world; however, they are not the same, and knowing how they differ may assist further protection. When we deal with personal information, there may be three situations:

• First, both privacy and security are maintained. Your personal information stays with you;
• Second, privacy may be compromised, but security is still maintained (Figure 1.3). Your personal information may not be only with you; and
• Third, both privacy and security are compromised.

This usually happens in case of a data breach.

FIGURE 1.2 The relationship between ethics, policy, and law.

Thus, privacy may be more often compromised than security. Privacy is concerned with the collection and use of data about individuals. Privacy is an ethical concern. Privacy breaches disrupt trust and initiate the risk of losing security. It disrespects the code of conduct and violates ethical principles. In Figure 1.3, we see that a group of laborers are working on ensuring security, however, they are seizing privacy [17].

1.3.1 DEFINITION 1.4: SECURITY

Security is essentially about protection against the unauthorized access of data. It is specifically conducted by deploying security controls to limit who can access the information. Security is primarily concerned with the protection of data while stored, in transit, and during processing, and the related informational assets like servers and mobile devices

FIGURE 1.3 Illustration showing security and privacy.

1.3.2 DEFINITION 1.5: PRIVACY

Privacy deals with an individual’s right to own the data that is originally triggered by his or her life and activities, and for restricting the outward flow of that data. personally identifiable information (PII), personal health information (PHI), Personal Financial Information (PFI), etc., are some private information related to a person.

Figure 1.4 describes privacy and security. Privacy deals with information collection, using, and disclosing personal information in an authorized manner, data quality and access to personal information. Security is primarily concerned with confidentiality, integrity, and availability.

1.4 THE NEED FOR CYBERETHICS

As we know, cyberethics deals with the responsible behavior that should be followed in cyberspace. The constituents of cyberspace are the internet, computer systems, telecommunications networks, and embedded processors and controllers in critical industries. All these components are interconnected, but have their own ways of operating. All these are subject to different ethical issues, as they work in different ways. Therefore, the Ethics that must be applied and followed in each of these domains might also differ. We should be concerned because it may have a bad effect not only in cyberspace but also on people who are interacting with these systems as we all do with each other over cyberspace [7]. Some of the situations that require us to follow Ethics in cyberspace are as follows:

FIGURE 1.4 Differences between privacy and security.

1. Social media constitutes a significant part of cyberspace, and the number of users in social media is very high. These are the platforms where people can express their opinions anonymously in the free society. However, these platforms also witness anonymous postings to blogs, websites, and social media that can encourage bad behavior anytime. Bullying, harassment, stalking, gender inequality, human rig...

Table of contents

• Cover Page
• Half-Title Page
• Title Page
• Copyright Page
• About the Authors
• Table of Contents
• Abbreviations
• Preface
• Introduction
• Part I: Cybersecurity: Ethics and Legal
• Part II: Cybersecurity: Risks and Policies
• Bibliography
• Index