Please enable JavaScript.

Coggle requires JavaScript to display documents.

IS Ethics - Coggle Diagram

- - - - Virtualizations software
    - - BYOD?
    - - Not verifying credentials
      - Sharing of logins and passwords
  - - - Increased reliance on commercial software
        
        0-day attack: takes place before security community or dev knows about vulnerability
        
        Exploit: takes advantage of particular vulnerability
        
        Virus: piece of code that cause computer to behave in an unexpected and undesirable manner
        
        Worm: Harmful program that resides in active memory
        
        Trojan horse: malicious code hidden in seemingly harmless program
        
        Blended threat: combines features virus, worm, Trojan horse
        
        Spam: use of email systems to send unsolicited email to large numbers of people
        
        CAN-SPAM act: includes restrictions for SPAM
        
        CAPTCHA: prevents spam by generating tests for humans
        
        Ransomware: locks system
        
        DDOS: floods bandwidth of system
        
        Phishing: Fraudulently using email
        
        Spear-phishing: send fraudulent emails to a certain org's employees, often designed to look like high-level execs
        
        Smishing: legit-looking text message sent to people
        
        Vishing: Voice mail telling people to call a phone or access website
        
        Cyberespionage: development of malware that steals data from gov agencies, military contractors, political orgs, or manufacturing firms
        
        Cyberterrorism: intimidation of government or civ pop by using IT to disable critical national infrastructure
        
        Botnets and zombies
        
        Botnet: group of hijacked computers which are infected with malware and controlled by hackers
        
        Zombies are the computers taken over and used to distribute spam and malicious code
    - - Uncencrypted VOIP
      - Email interception
      - Malicious attachments
      - Use of fixed addresses
    - - Sloppy security
      - Tricking employees into revealing ingo
      - BYOD policies
  - - - Hacker: Hired to test limits of a system
      - Cracker: Criminal hacker who causes disruption, steals data, has malicious intent
      - Malicious insider: Insider threat to an organization
      - Industrial spy: steals company trade secrets
      - Nelgigent insider: poorly trained employees
      - Cyberterrorist: seeks to destroy infrasturcutre components such as power grids, financial institutions, government, to cause disruption, chaos, and disaster
      - Hactivist: for politics
      - Cyber criminals: seeking financial gain
      - Black hat hacker: someone who violates computer or Internet security maliciously for illegal personal gain
  - - - Identify investments
      - Assess risks
      - Asset - software or hardware
      - Loss event - any event that can result in the loss of assets
  - - - Processes that are pivotal to continued operations
  - - - Usernames and password
      - Fingerprints
      - Voice pattern
      - Retina
      - Biometrics
      - One-time passwords
  - - - Encryption Key
      - Transport Layer Security
    - - VPNs
    - - Monitors system resources
      - Behavior: models behavior
      - Knowledge: documents specific attacks
    - - Implement Safeguards
      - Detect breaches
      - Conduct periodic audits
  - - - Who to notify
      - Authorities
      - Customers
  - - - Combines element of law and computer forensics
      - Proper handling of computer forensics
  - - - Use of email attachments
      - Use of wireless devices
      - Training
      - Employee beaviors
- - - - Shareholders
      - Consumers
      - Employees
      - Community
      - Environment
      - Suppliers
    - - Gain goodwill of community
      - Create consistent organization
      - Foster good business practices
      - Protect against legal action
      - Avoid unfavorable publicity
  - - - Employees willing to seek advice
      - Employees prepared to handle situations that lead to misconduct
      - Rewarded for ethical behavior
      - No rewarding success through questionable means
      - Feel positively about company
    - - Senior-level manager who reports to CEO
      - Ensures compliance with ethical procedurs
      - Serves as key contact for ethics issues
      - Create and maintain ethics culture envisioned by highest level of corporate authoirty
    - - Board of Directors responsible for careful and responsible management of organization
      - Conduct themselves according to highest standards of personal and professional intergrity
      - Set standard for company-wide ethical conduct
      - Create environment for employees to behave ethically
    - - Highlights organization's key ethical issues
      - Identifies the overarching values and principles important to the organization and its decision making
      - Apply to directors, officers, and employees
      - Focus employees on areas of ethical risk
    - - Reviewing ethical and social responsibility goals for upcoming year
      - Share info with stakeholders
    - - A comprehensive ethics education program promoted to encourage employees to act ethically
      - Encourage employees to report any misconduct
      - Show employees effective ways of reporting incidents
      - Reassure employees that such feedback will be acted on and that they will not be subject to retaliation
    - - Treating other with respect
      - Operating effectively in a multicultural environment
      - Accepting personal accountability for meeting business needs
      - Continually developing others and themselves
      - Operating openly and honestly with suppliers, customers, and other employees
- - - - Depends on each individual's cultural acceptance of norms
      - Different cultures employ different norms or standards
      - Ethics seen through own lens
    - - The good is whatever is pleasing to the person
      - We know our own needs so must act in our desires
    - - Opposite of egoism
      - Moral correct action serves best interest of others
    - - To do what is morally right is one's duty
      - Humans are torn between passions, drive, desires, and the ability to make good choices
      - The only thing that is good is good will
    - - Jeremy and Stuart Mill
      - The greatest amount of good for the greatest amound of people
      - Act vs Rule
        
        Act - when someone performs an act, consider what will create the most total happiness
        
        Rule - One should do the right thing since consequences are based on straight moral rules. Make moral decisions and follow the pattern that will produce good outcomes
  - - - are selfish
      - can only survive by banding together
- - - - Trade secret: Information that a company has taken strong measures to keep confidentials
      - Whistle blowing: An effort by an employee to attract attention to an act by a company that threatens the public interest
    - - Conflict of interest: between worker's interest and client
      - Fraud: obtaining products thorugh deception or trickery
      - Misrepresentation: the misstatement or incomplete statement of a material fact
      - Breach of contract: occurs when one party fails to meet the terms of a contract
    - - FCPA: Makes it a crime to briber a foreign official or candidate for foreign political office
    - - Relationships between IT workers and society
        
        Society expects members of a profession to provide significant benefits and not cause harm
      - Characteristics of a professional
        
        Expert in tools or skills needed to do their job
        
        Adhere to high ethical and moral standards
        
        Produce high quality results
        
        Meet commitments
        
        Communicate effectively
      - Improve reputation for professionalism by:
        
        subscribing to code of ethics
        
        A statement of principles and core values
        
        Provides:
        
        Ethical decision making
        
        High standards of practice and ethical behavior
        
        Trust and respect
        
        joining and participitating in professional organizations
        
        Association for Computing Machinery (ACM)
        
        Institute of Electrical and Electronics Engineers Computers Society (IEEE-CS)
        
        Association of Information Technology Professionals (AITP)
        
        SysAdmin, Audit, Network, Security Institute
        
        PMI
        
        Obtaining certifications
        
        A certofocatopm is no substitute for experience
        
        Supporting governmnent licensing where possible
    - - Bribery: act of providing money, property, or favors to obtain a business advantage
      - Internal control: The process established to provide reasonable assurance and efficiency for operations, the reliability of financial reporting
      - Separation of duties: the act of ensuring that different aspects of processes involving financial transactions are handled by different people
  - - - Improves IS
      - Encourages IT workers to follow highest standards
      - Without licensing: No well defined requirements for heightened care and no profession concept of malpractice
    - - Define ethical standards
      - Define required body of knowledge and recommended practices in software engineering
      - Define appropriate curricula to acquire knowledge
    - - Negligence: not doing something a reasonable person would od
      - Duty of care: obligation to protect people against unreasonable harm or risk
      - Reasonable person standard: a standard used by courts to evaluate how an objective, careful, and conscientious person would have acted
      - Reasonable professional standard: used to measure actions of professionals who have particular expertise or competence
    - - Breach of duty of care: failure to act as reasonable person would act
      - Professional malpractice: liability of professional who breach the duty of care, resulting in negligent care and injuries
      - Professional negligence can only occur with set standards
  - - - Has negative impact on future software development
      - Android OS has contributed
    - - Erodes worker productivity
      - Can lead to harassment lawsuits
    - - Privacy violation
      - Competitive erosion
    - - Establish guidelines for use of company hardware and software
      - Define acceptable use policy
        
        A document that stipulates restrictions and practices that user must agree to in order to use org computing and network resources
        
        Clear and concise
        
        Has 5 key elements
        
        Purpose
        
        Scope
        
        Policy
        
        Compliance
        
        Sanctions
        
        Infosec group responsible
      - Structure information systems
      - Install and maintain a company firewall
        
        Firewall: hardware or sotware that serves as first line of defense between org nework and Internet; also limits access to company network
      - Compliance
        
        To act in accordance with established policies, guidelines, specs, lefgislation
        
        HIPAA, Sarbox
        
        Audit
        
        Assures quality and integrity of accounting and reporting practices
        
        Compliance with legal and regulatory requirements
        
        Qualifications, independence, and performance
        
        Performance of company's internal audit team
        
        Determine that internal systems and controls are effective
        
        Verify existence of company assets and maintain proper safeguards
        
        Measure org's compliance with own policies
        
        Ensure policies and procedures are followed
        
        Evaluate adequacy and reliability of information available
      - No policy can stop wrongdoers