Ethics and the Information Security Profession
Ralph Spencer Poore · Information Systems Security · 1999
Whether you subscribe to a professional code of conduct1 or you just claim to be the “good guy” who is protecting the information assets of your organization, your colleagues, your employer, and those whose information you protect expect you to behave ethically. In this context, I use ethics to mean “the rules or standards governing the conduct of the members of a profession.”2 How- ever, elements of its common use as a synonym for morals also apply. Ethical conduct includes both acts of commission and acts of omission. We have obligations to perform certain tasks and obligations not to perform others. Just as a soldier may be held to account for accepting an unlawful order, so may the information security professional be held to account for acceding to management requests if they would violate professional ethics. I have found, however, a wide diversity of opinion among people who assert professional status in our field.