Ethics

This section reviews some of the ethical standards and codes that a CISSP should be aware of. Ethics are a set of principles of right conduct. Ethical standards are sometimes different than legal standards: Laws define what we must do, whereas ethics define what we should do. CISSPs should uphold high ethical standards and promote these ethical standards in others. Some of the ways CISSPs can help promote proper ethical behavior include making sure that organizations have guides to computer ethics, ensuring that ethical issues are included in employee handbooks, promoting computer ethics training, and helping to develop ethical policies on issues such as email and other privacy-related topics. With that being said, you must also remember that not everyone will always act ethically.

Some of the reasons you might hear include the following common ethical fallacies:

• Computer game If they don't protect it, it's fair game to attack.
• Law-abiding citizen It's not physical theft, so it's not illegal.
• Shatterproof If I don't do damage or it can be repaired, what's the problem?
• Candy-from-a-baby If it is that easy, how could it be wrong?
• Hackers If I learn from this, it will benefit society and me.
• Free information All information should be free.

ISC2 Code of Ethics

It's a requirement for CISSP candidates to subscribe to and support the ISC2 Code of Ethics, which states that a CISSP should

• Protect society, the commonwealth, and the infrastructure
• Act honorably, honestly, justly, responsibly, and legally
• Provide diligent and competent service to principals
• Advance and protect the profession

Computer Ethics Institute

The Computer Ethics Institute is a group that focuses specifically on ethics in the technology industry. Its website, www.cosr.org, lists the following Ten Commandments of Computer Ethics:

1. Thou shalt not use a computer to harm other people.
2. Thou shalt not interfere with other people's computer work.
3. Thou shalt not snoop around in other people's computer files.
4. Thou shalt not use a computer to steal.
5. Thou shalt not use a computer to bear false witness.
6. Thou shalt not copy or use proprietary software for which you have not paid.
7. Thou shalt not use other people's computer resources without authorization or proper compensation.
8. Thou shalt not appropriate other people's intellectual output.
9. Thou shalt think about the social consequences of the program you are writing or the system you are designing.
10. Thou shalt always use a computer in ways that ensure consideration and respect for your fellow humans.

Internet Activities Board

RFC 1087 was published by the Internet Activities Board (IAB) in January 1987. Its goal is to characterize unethical and unacceptable behavior. It states that the following activities are unethical:

• Seeking to gain unauthorized access to the resources of the Internet
• Disrupting the intended use of the Internet
• Wasting resources (people, capacity, computer) through such actions
• Destroying the integrity of computer-based information
• Compromising the privacy of users