TechFite Cybersecurity Ethics: Issues, Policies & SATE

Introduction

The case of the publicly traded company TechFite reveals a substantial number of ethically questionable activities being committed by the company's Applications Division. Not only are there accusations of theft of proprietary information, but there is also evidence of conflicts of interest, dummy accounts used to gain escalation of privilege, and security omissions that cannot be justified. This paper addresses the ethical issues in cybersecurity that relate to the TechFite case, discusses the ethically questionable behaviors and omissions of individuals who fostered the unethical atmosphere, and examines ways to mitigate problems and enhance security awareness at the company.

Ethical Guidelines for Information Security

When it comes to establishing ethical guidelines in cybersecurity, the primary concern is protecting data. Whether in health care, finance, or technology, data security must be the foremost issue—meaning that confidentiality, integrity, and access must all be secured, according to the Information Systems Security Association International (ISSA, 2018). In the case of TechFite, a number of ethical issues have emerged with respect to confidentiality, integrity, and access. Before examining them, however, it is useful to review the relevant guidelines.

Privacy is the fundamental ethical issue that governs most guidelines in information security (Shinder, 2005). All clients have a reasonable expectation of privacy with respect to their proprietary information, which is why clients sign non-disclosure agreements. Protecting information is therefore a key ethical responsibility in information security. Keeping client data segregated—for example, by using a Chinese Wall—is important. Limiting administrative rights within a department and granting access only from monitored computers is another guideline that should be standard throughout the industry (GIAC, 2018).

Privacy serves as the underlying foundation of all ethical guidelines related to information security because the very essence of the field is rooted in keeping information out of the hands of those who should not have access to it. The digital age has enabled information flows in ways that are easier than ever before; however, that ease carries a price—the risk of those flows being compromised. The guiding ethical principle in information security is that data should be shared only with those who have permission to view it.

A clear example can be found in the health care industry, where patients' rights are codified in HIPAA law, which stipulates that all patient information stored digitally must be protected by health care facilities. When Anthem Blue Cross suffered a breach of 78 million patient records, it became a landmark case demonstrating just how important the fundamental ethical principle of privacy is in the field of information security (Lord, 2018).

Within the field, additional guidelines must also be followed—such as protecting proprietary information and implementing basic security systems like Chinese Walls. As Brewer and Nash (1989) point out, "it should be noted that in the United Kingdom the Chinese Wall requirements of the UK Stock Exchange have the authority of law and thus represent a mandatory security policy whether implemented by manual or automated means" (p. 206). In other words, these basic guidelines are recognized as law in many parts of the world, where ethical practice in information security is effectively mandated by government.

Behaviors and Omissions That Fostered Unethical Practices

The behaviors and omissions at TechFite that fostered unethical practices were numerous. The IT Security Analyst assigned to the division was one of the main culprits, though not the only one. The analyst's reports indicated that the company had done well in protecting against external threats; however, documentation of internal threats was entirely absent. There was no description of whether accounts had been audited, whether the division was monitoring for escalation of privilege, whether data loss prevention was being enforced, or whether internal network traffic was being monitored. All of these items should have been addressed in detail in internal reports. Their omission represents a serious ethical transgression, given that the analyst was responsible for overseeing the division.

There was also no analysis of the process used to secure the proprietary information of current, past, or future clients. All data appears to have been stored together, accessible from any computer in the division. There was no Chinese Wall, no distinction between privilege and duty, and every workstation carried full administrative rights—meaning all information could be accessed from any location within the division.

The head of the Applications Division also engaged in ethically questionable behavior. Social media evidence indicates a close personal relationship between the division head and the IT Security Analyst; the division head routinely praised the analyst to the analyst's supervisor. If the analyst was conducting oversight of the division head, the latter should not have been offering gifts or favors to the former. The company, however, had no policy governing relationships between IT security staff and the individuals they oversee—a significant organizational failure that effectively permitted conflicts of interest to flourish.

The division head had never audited the client list database. Three client corporations were discovered to be shell companies owned by a personal acquaintance of the division head. Accounts were created that were used to discuss dumpster diving and trash surveillance with non-clients of the company—activity that is both unethical and non-transparent. The systems were also found to contain system penetration software. A senior analyst within the division was similarly engaged in covert and potentially illegal activity, including scanning other companies' networks. The fraudulent accounts also obtained escalation of privilege beyond the division, gaining access to both HR and finance systems.

Two Information Security Policies to Mitigate Problems

One policy that may have prevented or reduced the criminal activity, deterred negligent acts, and decreased threats to intellectual property at TechFite would be the establishment of a Chinese Wall. As Brewer and Nash (1989) point out, "the Chinese Wall policy combines commercial discretion with legally enforceable mandatory controls. It is required in the operation of many financial services organizations" (p. 206). By having a Chinese Wall in place, the company would mitigate the risks associated with escalation of privilege, dummy accounts accessing sensitive data, the abuse of full administrative rights at workstations, and the theft of proprietary information from within. The Chinese Wall works by preventing conflicts of interest from arising through the strict limitation of access to datasets by group membership. Brewer and Nash (1989) describe the mechanism as follows: "access to data is not constrained by attributes of the data in question but by what data the subject already holds access rights to. Essentially, datasets are grouped into 'conflict of interest classes' and by mandatory ruling all subjects are allowed access to at most one dataset belonging to each such conflict of interest class; the actual choice of dataset is totally unrestrained provided that this mandatory rule is satisfied" (p. 207). By segmenting and segregating conflict-of-interest classes, the company eliminates the ability of internal operators to harvest proprietary client information and pass it to outside parties.

A second policy that may have prevented or reduced the criminal activity, deterred negligent acts, and decreased threats to intellectual property would be the implementation of routine network monitoring and internal auditing of account activity. Monitoring network activity would have revealed that penetration and scanning activity was being conducted against various external companies, indicating unethical data harvesting by employees. Auditing of accounts would have exposed fraudulent payment activity related to these operations conducted through off-the-books methods.

Conclusion

TechFite is in a position where information security is not being pursued within its departments and divisions. The individual responsible for oversight has not conducted the types of audits and monitoring required to mitigate internal threats. The necessary infrastructure—such as a Chinese Wall—is not in place to prevent the unauthorized access to and theft of proprietary information. These omissions are serious in themselves, but the active unethical conduct among certain workers indicates that some of this misconduct has been deliberate.

The primary remediation strategy is to implement two specific policies that directly address the observed activity and omissions. The first is to establish a Chinese Wall around proprietary client information. This would fulfill the primary ethical principle in information security: the obligation to protect and safeguard all private data. The second is to implement a system of routine network monitoring and account auditing. This would ensure that the network is not used recklessly or in ways that endanger the company's reputation. Workers who engage in unethical behavior would be identified and disciplined. The company currently has no conflict-of-interest policy—a gap the Chinese Wall would begin to address. Equally important is ensuring that all workers understand the reason these controls are being introduced: not to monitor them as suspects, but to protect the intellectual property that the company and its clients depend upon.

References

Brewer, D. F., & Nash, M. J. (1989, May). The Chinese wall security policy. In Proceedings: 1989 IEEE Symposium on Security and Privacy (pp. 206–214). IEEE.

GIAC. (2018). Code of ethics. Retrieved from https://www.giac.org/about/ethics

ISSA. (2018). Code of ethics. Retrieved from

Lord, N. (2018). Top 10 biggest healthcare data breaches of all time. Retrieved from https://digitalguardian.com/blog/top-10-biggest-healthcare-data-breaches-all-time

Patrick, N. (2018). 9 signs your security awareness training is failing. Retrieved from

Shinder, D. (2005). Ethical issues for IT security professionals. Retrieved from https://www.computerworld.com/article/2557944/ethical-issues-for-it-security-professionals.html