Ethics & Information Security

Explain the ethical issues surrounding information technology.

The ethical issues surrounding information technology are:

§  Privacy
Privacy is the right to be left alone when you want to be; to be able to have control over your own personal possessions, and not to be observed without your own consent.

§  Confidentiality
‘The assurance that messages and information are available only to those who are authorised to view them.’

Describe a situation involving technology that is ethical but illegal.

A situation could be where a person purchases software and makes a copy of it, not to sell but, to keep as a back-up.

Describe and explain one of the computer use policies that a company might employ.

Ethical Computer Use Policies contain general principles to guide computer user behaviour. An example of this might be:

§  Management telling the employees to refrain from playing computer games during work hours. This policy says that the employees should behave at work and shows authority within the company.

What are the 5 main technology security risks?

The main five technology security risks are:

1.      Human Error

-        Not malicious

-        Sometimes unavoidable if employee isn’t trained properly

2.      Natural Disasters

-        Floods

-        Earthquakes

-        Terrorist attacks

3.      Technical Failures

-        Software bugs

-        Hardware crashes

4.      Deliberate Acts

-        Sabotage

-        White collar crime

-        Hacking

5.      Management Failure

-        Lack of procedure

-        Lack of documentation

-        Lack of training

Outline one way to reduce each risk.

1.      Human Error

-        Training – properly trained employees won’t make the same amount of errors.

2.      Natural Disasters

-        Proper natural disaster plans – plans that map out what the company will do in case of a disaster.

3.      Technical Failures

-        Back-up files

-        Spare equipment

4.      Deliberate Acts

-        Password protection – including strong passwords and regularly changing them.

-        System audits.

-        Strong penalties for misuse.

-        Firewalls.

5.      Management Failure

-        Training.

-        Documentation.

-        Procedure.

What is a disaster recovery plan, what strategies might a firm employee?

A disaster recovery plan is a plan that outlines exactly what to do when a disaster strikes. A strategy that a firm might include:

§  Communications plan

§  Alternative sites – hot or warm

§  Business continuity

§  Keeping data stored off-site

§  Well documented procedure

§  Regular recovery testing