SEC2102: Ethics in Cyberspace and Cybersecurity - Lecture 1

Flashcards covering definitions, differences, principles, and frameworks of Cyberspace, Cybersecurity, the CIA triad, Privacy, Ethics, Cyberethics, Cybersecurity Ethics, Cyber Law, Cybersecurity Law, and Cyber Policy based on Lecture 1 of SEC2102.

What is the primary textbook designated for the SEC2102 course?

CYBERSECURITY: Ethics, Legal, Risks, and Policies (2022) by Ishaani Priyadarshini and Chase Cotton.

How is cyberspace defined?

Cyberspace is the virtual, non-physical environment created by interconnected computers, networks, software, and the internet where digital communication and data exchange happen.

How is cybersecurity defined?

Cybersecurity refers to the body of technologies, processes, and practices designed for the protection of networks, devices, programs, and data from attack, damage, or unauthorized access.

How do cyberspace and cybersecurity differ regarding their nature and strategic purpose?

Cyberspace is an open, neutral environment that enables digital activity, communication, and access; cybersecurity is a protective, strategic defense system that aims to control risks, secure assets, and protect that environment from harm.

What are the three pillars that comprise the cybersecurity triad?

Confidentiality, Integrity, and Availability (the CIA triad).

What does confidentiality mean within the cybersecurity triad?

Ensuring information is safe from accidental or intentional disclosure so that data is kept private.

What does integrity mean within the cybersecurity triad?

Ensuring information is safe from accidental or intentional modification or alteration so that data is kept reliable, accurate, and unchanged.

What does availability mean within the cybersecurity triad?

Ensuring information is available and reachable to authorized users whenever it is needed.

What is the primary operational distinction between security and privacy?

Security focuses on protecting data from unauthorized access while stored, in transit, or during processing (governed by the CIA triad); privacy deals with an individual's right to own data triggered by their life and activities and control its outward collection, disclosure, and quality.

How is 'Ethics' defined in the hierarchy of rules, and what is its primary focus?

Ethics is the core umbrella of moral philosophy that explores fundamental ideas of justice, honesty, and rights outside of any technology context, focusing on universal principles of human morality.

What is 'Cyberethics', and who does it apply to?

Cyberethics is the code of responsible behavior and digital etiquette over cyberspace (such as not pirating software, respecting anonymity, or avoiding trolling) that applies to everyday internet users.

What is 'Cybersecurity Ethics', and who establishes its guidelines?

A professional code of conduct guiding technical professionals who hold significant digital privileges (such as ethical hackers, IT administrators, and engineers), established by technical professional boards like ISC² and SANS.

What is 'Cyber Law', and what is its primary focus?

Legally binding statutes created by federal, state, and international governments that introduce formal legal enforcement to digital behaviors, focusing on criminal actions and consumer rights.

What is 'Cybersecurity Law', and which entities must comply with it?

Government mandates concentrating strictly on defense, risk management, and national security that establish minimum required network defenses for critical organizations such as critical infrastructure, banks, and hospitals.

Which authority enforces cybersecurity law and protects digital infrastructure and data centrally in Saudi Arabia?

The National Cybersecurity Authority (NCA).

What is a 'Cyber Policy', and who creates it?

A localized set of internal compliance rules defining behavioral expectations for technology use within an organization, created by executive leadership and the internal IT team.

How are Ethics, Policy, and Law contrasted in terms of behavioral expectation in this relationship diagram?

Ethics dictates what one 'should' do, Policy dictates what is 'usually' expected, and Law dictates what one 'must' do.

In the case study of a data breach, how do Cyber Law, Cybersecurity Law, and Cyber Policy differ in their core rules?

Cyber Law defines illegally accessing a network to steal data as a crime; Cybersecurity Law mandates that companies encrypt data and report breaches to the government; Cyber Policy requires employees to lock computers and never share passwords.

In the context of a data breach, how do the core definitions of Ethics and Cyberethics compare?

Ethics states that stealing or exposing secrets is morally wrong, whereas Cyberethics states that accessing and leaking private files online is bad behavior.

In the context of a data breach, what is the core mandate of Cybersecurity Ethics?

Security experts must protect systems and never abuse administrative access.