I'm compiling a list. What ethical dilemmas do we face in the field of infosec?
Example:
Your client/customer asks you to remove an embarrassing finding from your pentest/assessment report. Do you?
Your client/customer asks you to remove an embarrassing finding from your pentest/assessment report. Do you?
Example:
You find your client/customer is breaking the law (such as not disclosing a big breach as required by law). Do you contact the police?
You find your client/customer is breaking the law (such as not disclosing a big breach as required by law). Do you contact the police?
Example:
You've signed an NDA, but then want to talk to the press about it, keeping your name and customer's name anonymous.
You've signed an NDA, but then want to talk to the press about it, keeping your name and customer's name anonymous.
Example:
Building tools that can be used for both (evil) attack and (good) defense:
Building tools that can be used for both (evil) attack and (good) defense:
Example:
An obvious fraud (e.g. Gregory Evans) promotes himself and appears often on TV. Should you point this out, or ignore it?
An obvious fraud (e.g. Gregory Evans) promotes himself and appears often on TV. Should you point this out, or ignore it?
Example:
You see a URL ending in ?articleId=473. Do you increment it to 474 in order to see what happens? Do you script this to grab all sequential article IDs? Note: I'm asking the 'ethical' question here, not debating the 'legal' question.
You see a URL ending in ?articleId=473. Do you increment it to 474 in order to see what happens? Do you script this to grab all sequential article IDs? Note: I'm asking the 'ethical' question here, not debating the 'legal' question.
Example:
Is breaking the law inherently unethical? You live in a country where encryption is outlawed, do you help activists encrypt their stuff?
Is breaking the law inherently unethical? You live in a country where encryption is outlawed, do you help activists encrypt their stuff?
Example:
This recent incident (Kasperky outing a U.S. malware campaign against ISIS) brings up a lot of ethical questions:
This recent incident (Kasperky outing a U.S. malware campaign against ISIS) brings up a lot of ethical questions:
Example:
When @d0tslash decided to disclose DJI (the drone company) vulns rather than accept the $30k bribe to cover them up.
When @d0tslash decided to disclose DJI (the drone company) vulns rather than accept the $30k bribe to cover them up.
Example:
When is it bribery? The salesperson invites you to an exclusive RSAC party, pays for dinner, takes you golfing, gives you $10k under the table in order to choose their product? A lot of you are getting drunk on free booze at RSAC vendor parties right now.
When is it bribery? The salesperson invites you to an exclusive RSAC party, pays for dinner, takes you golfing, gives you $10k under the table in order to choose their product? A lot of you are getting drunk on free booze at RSAC vendor parties right now.
(I don't mean that last one as criticism, btw, but just want to list it)
