Homework 1 - Case Study on Professional Ethics
Researchers focusing on vulnerability discovery, code analysts working for
clients, and security assurance code analysts working for an employer all
share a professional code of ethics. For the most part, this code of ethics
follows those prescribed by security organizations such as (ISC)2,
ISACA, and ISSA.
Professional ethics resources:
When it comes to vulnerability analysis one of the biggest ethical debates
centers around how to disclose discovered vulnerabilities. There are three
basic models for vulnerability disclosure:
- Full Disclosure - Publish all information about the vulnerability without
contacting vendor about the issue. Full disclosure is intended to let users
have knowledge of the risk and possible mitigation measures as soon as
possible. Proponents also feel full disclosure pressures the vendors to
respond to vulnerabilities that they might otherwise ignore.
- Non-disclosure - Keep the vulnerability information private or just send
the vulnerability information to the software vendor and never publish the
information. Ethical non-disclosure can also involve non-disclosure
agreements, which are typical of third party source code audits of
proprietary software. Non-ethical non-disclosure can involve selling the
vulnerability to the "highest bidder" or otherwise using it for personal
gain (e.g. writing exploits, trading it on the black market for other
vulnerability information, etc.)
- Coordinated/Responsible Disclosure - First send the vulnerability just to
the vendor (or to a neutral third party who handles the rest of the
disclosure process). Give the vendor sufficient time to verify the
vulnerability and devise a fix. Coordinate the release of the fix/patch
and the publication of information about the vulnerability. If the vendor
does not respond in a timely fashion, fully publish the vulnerability to
inform the users and put pressure on the vendor (as with full disclosure).
The following links give more information about each approach, the policies
of several organizations, and more information about the debate between full
disclosure proponents and coordinated disclosure proponents.
Whitepapers and Blogs on Vulnerability Disclosure:
Vulnerability Disclosure Policies for Various Organizations:
Debates between Disclosure Models:
As a real world example of when this debate might come into play, look at the
following CNN Money article on Apple's slow repair of some vulnerabilities: http://money.cnn.com/2015/04/22/technology/mac-security-flaw/index.html
Ethical Reasoning
Ethical dilemmas can arise when what we should do is at odds with the current
situation or when competing "shoulds/oughts" are in play. There is not always
just one "right way" to resolve the dilemma or one "proper" course of action.
The crux of the vulnerability disclosure debate is an ethical dilemma between
full disclosure and coordinated disclosure.
When analyzing the vulnerability disclosure debate, we can use ethical
reasoning tools. There are three common ethical approaches:
- Consequentialist approach - What are the results or consequences from each
course of action? Keep in mind that ethically questionable decisions can
result in good consequences, so this approach is not always sufficient on
its own.
- Respect for persons (deotological) approach - Are people being treated as
they deserve to be treated? Would you be okay if you were on the
"receiving end" of the decision?
- Ethics of aspiration approach - Is the action/decision being considered
consistent with what you aspire to be? How would you feel if your
grandmother or mother heard about the action/decision? This approach
focuses on good character and striving for excellence instead of rules.
These approaches can be combined with an ethical reasoning methodology to help
analyze a situation. One methodology is as follows:
- Identification/recognition of dilemma - Identify issues and stakeholders
- Analysis - Assess possible decisions/actions in terms of the above three
ethical approaches. Keep in mind that legal does not always mean moral,
and that there may be cultural differences in ethical analysis.
- Justification - Look for convergence between multiple ethical approaches
in the analysis stage. May require revisiting the analysis stage in hard
cases, keeping in mind complete convergence is often not possible.
- Decision/action - Make decision based on above stages. May not be a best
possible course of action since there is often incomplete data available.
Assignment
The assignment for this case study is the following:
- Using Steps 1 and 2 above, analyze the vulnerability disclosure debate.
Your analysis should include the pros and cons of each approach (e.g. what
are the consequences of each approach).
- Using your analysis, make an argument for full disclosure and against
coordinated disclosure.
- Using your analysis, make an argument for coordinated disclosure and
against full disclosure.
You may discuss this assignment in groups, but every student needs to write
up their own responses to the above three questions in their own words. You
can NOT upload one response for the entire group.
Upload your responses to Moodle, either as a DOC, PDF, TXT, or ODT file or
using the Moodle text box.