Nicole Overend
Ethical Code Statement
Developed in ITDE 201
PREAMBLE - The field of cybersecurity is dedicated to protecting, saving, but not invading
computer systems from malicious attacks, and raising awareness of good security practices.
Ethics are essential in this field of work because they are the only thing separating cybersecurity
from cybercriminals.
EXPLANATION OF HOW THE CODE WAS WRITTEN - The preexisting ethic codes
constructed by the National Institute of Standard and Technology (NIST), the Computer Fraud
and Abuse Act (CFAA), and the General Data Protection Regulation (GDPR) were consulted.
Along with the Aggie Honor Code and my personal morals constructed from my parents morals
and Catholicism.
CANONS AND REFLECTIONS
1. Cybersecurity professionals should not trespass on other’s computer systems without
explicit authorization from the owner of the computer system.
REFLECTION - The only thing separating me from a cyber criminal are my actions. We
have the same knowledge, tools, and resources, so it's paramount that I don't abuse
them. With great power comes great responsibility. Unfortunately to do my job, I have to
gain access to the victim’s computer system, but this can be done legally and through
asking permission. The CFAA makes computer trespassing illegal, which is the catchall
that sends most cyber criminals to jail.
2. Cybersecurity Professionals should not harm others' computer systems.
REFLECTION - I’m in this profession to help people, not cause them ham. Its similar to a
doctor’s pledge to do no harm. It might lead to criminals getting away or putting my life at
risk, but I will not harm other people through my cybersecurity knowledge and abilities.
3. Cybersecurity Professionals should always be willing to help, even if they will not be paid
for their services.
REFLECTION - Cybersecurity is very similar to the medical profession. If someone
needs help and their computer has been hacked or ransomed, I will help. It might cause
me to lose money or help an inherently bad person, but it's very important to stand by
this. I entered this profession to help people, I will not let something trivial like money or
past mistakes stop me. With great power comes great responsibility.
4. Cybersecurity professionals should not copy unnecessary files from the victim's
computer system and store necessary files securely and with an evidence log.
REFLECTION - Copying unnecessary files is an invasion of privacy. The files that are
needed are still someone’s private information and should be handled as such. Its my
responsibility that if I copy someone’s personal information, I try to keep it as secure and
safe as possible. In addition, evidence logs are very important in criminal trials to prove
that the evidence was not tampered with. They also show the owner that their
information was only handled by authorized people and their privacy was kept to the
best of my ability.
5. Cybersecurity professionals should strive to keep a victim’s privacy.
REFLECTION - If I don’t value the victim’s privacy, I might as well have attacked them. It
is paramount to keep a victim’s privacy. Its similar to theft. When a theft occurs, the
victim feels violated and exposed. Usually the police leave the report sparse and only
with the need to know, to let the victim have a sliver of privacy. As a cybersecurity
professional, I should not inflict more injury onto someone who is vulnerable. Which is
why it's essential to keep the victim’s privacy.
6. Cybersecurity professionals should keep the victims well informed throughout the
process and should not lie or withhold information.
REFLECTION - A cyberattack is a very scary time, and keeping the victim well informed
is paramount. During the ordeal the victim is helpless, keeping them updated helps them
feel in control. Even if the news is bad, I will still let them know. Similar to a doctor, you
don't want them to lie to you or not tell you something even if it's terrible news. It's the
victim’s right to know what's happening and everything that is being done to stop it.
7. Cybersecurity professionals should not abuse their power.
REFLECTION - It's abhorrent that anyone would abuse their power like this. A victim of
a cyberattack is vulnerable and scared, and using their weakness to get more money or
something is horrible. I will not abuse my power. Even if it means that I'll get fired, I will
not abuse anyone’s weakness. If the situation is morally gray, I will not do it. Unless I
know that I am not abusing my power and knowledge, I will not do anything.
IN CONCLUSION - It was very hard for me to reflect on the canons above, because I don't want
to imagine anyone in my profession breaking these. I will never break these. Because to me
these are common sense and basic human kindness.
