Moral Responsibilities of Information Security Professionals

Moral Responsibilities of Information Security Professionals

Information security (IS) professionals are individuals whose job it is to maintain system and information security. By standing of their profession, they have a professional responsibility to assure the correctness, reliability, availability, safety and security of all aspects of information and information systems. The discussion in the above sections makes clear that this responsibility has a moral dimension: professional activities in computer security may protect people from morally important harms but could also cause such harms, and may either protect or violate people’s moral rights. In case of safety-critical systems, the decisions of information security professionals may even be a matter of life or death. That IS professionals have moral responsibilities as part of their profession is reflected in codes of ethics used by various organizations for computer and information security. These codes of ethics rarely go into detail, however, on the moral responsibilities of IS professionals in specific situations. For instance, the code of ethics of the Information Systems Security Association (ISSA), an international organization of information security professionals and practitioners, only states that members should “perform all professional activities and duties in accordance with all applicable laws and the highest ethical principles” but does not go on to specify what these

ethical principles are or how they should be applied and balanced against each other in specific situations  For IS professionals, as well as for other computer professionals who have a responsibility for computer security, a code of ethics clearly is not enough. To appreciate the moral dimension of their work, and to cope with moral dilemmas in it, they require training in information security ethics. Such training helps professionals to get clear about interests, rights, and moral values that are at stake in computer security, to recognize ethical questions and dilemmas in their work, and to balance different moral principles in resolving such ethical issues