The supervision of research projects entailing computer risks within an academic context: the case of École Polytechnique de Montréal
Roehrig, Céline, José M. Fernandez · PolyPublie (École Polytechnique de Montréal) · 2009
— Information systems security aims to protect information assets, including data, computer systems and computing services, in terms of confidentiality, integrity and availability. The increasing use of information systems in society has led to growing concerns about the security of such systems in recent years. As a result, Ecole Polytechnique de Montreal has encouraged continued research efforts in this field for many years. The institution nevertheless also recognized the risks that this type of research might entail, particularly those research projects pertaining to the study of malicious computer programs (e.g. viruses), the study of vulnerabilities and the study of tools and methods used by malicious actors targeting information assets, or the use of data collected to support research efforts related to the use of actual computer systems. In early 2009, Ecole Polytechnique de Montreal implemented a procedure aimed at supervising the conduct of such research projects. This procedure, the first of its kind within a university context in Canada, aims to provide guidelines for the conduct of research projects which could either i) stop or damage the institution’s computer infrastructure, that of its partners or any other entity/individual; ii) damage the institution’s information assets, those of its partners or any other entity/individual; iii) incur financial losses to the institution, one its partners or any other entity/individual; iv) affect the availability, the integrity or the confidentiality of the institution’s data, that of its students, collaborators or any other entity/individual; v) be harmful to the reputation of the institution or that of one of its collaborators. This paper presents the objectives of this procedure, its underlying principles and the chosen approach to supervise the conduct of such research projects.