OVERVIEW OF ETHICAL ISSUES
such as Security, Confidentiality and Hacking in Software Engineering
Research work by Sana & Nayab
Abstract
Ethics are basically the moral principles that applies to the practices of engineering .Ethics are part of engineering because an engineer is socially responsible when manufacturing products and processes for society. Ethical issues emerge when some specific action or decision make contention with the ethical standards of the society. Engineering directly impacts on people’s quality of life. The services provided by an engineer must be secure, confidential and should be protected from any unethical use like illegal hacking. The objective of the paper is to find out why ethical issues such as security, confidentiality and hacking occurs/happens and we will analyze tools and techniques that can be used to overcome the ethical Issues. Finally this paper focuses on how effective proposed tools and techniques are in term of ethical issues with the evolution in technology.
Keywords: Ethical issues, Security, Confidentiality, Hacking.
1.Introduction
In the world of cooperation, ethics take part an
essential role for the employee and the
employer. Ethics is a set of rules or concept that
is regarded as standards, which are generally
forced by a community or a profession. They
can be expressed in the self-observation of the
individual and his constant attempt to become a
better human being on private level. In
professional life, it is considered as standards to
which all members of a profession are bound.
Engineering is the process of developing a well-
organized mechanism using technology.
In engineering, ethics are basically the moral
principles that apply to engineering practices. A
software engineer with ethics can assist and
provide his services in a better way by applying
them to most of the conditions which make an
appearance at work.
Engineering became a recognizable profession
in the 19th century. However, at that time, ethics was seen as a personal concern rather than a
professional one. In the beginning of 20th
century, there had been a sequence of notable
failures, these failures had intense repercussion
on engineers which enforced the profession to
face gaps in the technical practices and ethical
standards. So, the first codes of engineering
ethics were officially adopted by American
engineering companies in 1912-1914.
As of today, engineering ethics is a well-developed
area of professional ethics in the modern West
like medical, legal, and business ethics and
professional engineers are expected to both
know and abide by ethical standards as a
condition of belonging to the profession.
Why we need ethics in software engineering?
We need ethics in this particular field because a
software engineer shares a fundamental human
preference to prosper and be successful in life
and work with everybody. What does this have
to do with ethics? Picture a future where you are
faced with a moral dilemma resulting from a
project you are working on and which shows serious danger for end users.
In this kind of
scenario, are you going to act in a way that you
would be comfortable with if it later on exposed
to public? .So a software engineer is responsible
for providing services to society so his decision
must not make contention with the standard of
the society.
Why Software engineers face ethical issues?
The process of software development and
deployment in the Internet age has certain
eccentricity which make ethical issues for
software engineers even more critical in some
situations than for other types of engineers. First,
the shortened life cycle has weakened and in
some cases eliminating the review of software
by management and legal teams.
It’s normal for
engineers to code and deploy functionality
directly for instance for web applications like
Facebook. Even where more conventional
development practices are carried, partially
some deployments such as fixing bugs are
provided with technical (not ethical)
supervision. In any case, engineers retain at least
the capability to deploy code directly to users, a
capacity that can easily be misused. There are
considerable other ethical concerns that
engineers may confront. Some of them have to
do with technical practice, however numerous
others have to do with broader business conduct
considerations.
Some of them incorporate
security, confidentiality and hacking ethical
issues. Security refers to the entire activities required to
secure data or information and systems which
assists it in order to facilitate its legitimate or
proper use. Hacking and confidentiality comes
under security. Confidentiality is the practice to
keep the information as a secret only provided to
desirable mean .The maintenance of secrecy
refers to the unrevealing of any data concerning
the company’s business processes that are not in
public knowledge.
Every company can identify
the individuals and groups that might have access to a particular set of information. There
are many ways of breaking confidentiality, and
techniques to protect them from confidentiality
breach. So when confidential data or information
is leaked then it becomes an ethical issue for a
software engineer. According to the Code of
Ethics and Professional Practice when a
professional who is questioned about the
technical details of the employer’s forthcoming
product must choose between answering the
question completely and keeping the information
secret.
Hacking is the illegal and unauthorized access to
someone’s private data or system. Hacking can
be broadly divided into ethical and unethical
hacking. Unethical Hacking significantly affects
the development of systems and networks. This
is especially the case of systems and networks of
organizations where sensitive or confidential
information is used on regular basis.
Organizations or data holders must find
solutions and measures to protect information
technology assets. In this endeavor,
organizations can use ethical hacking which is
used to find loopholes in a software .
To achieve
better results through ethical hacking include the
total authorization of hired hacker for the testing
of software. Due to some security reasons all the
information is not provided which may result as
a loophole in system. Our study focuses on why
we need to consider these ethical issues in
software engineering and how we can overcome
these ethical issues.
Background
Ethics are defined as standard for differentiating
well from bad and the elaboration of ethics
solely cannot give perceptions of conduct for
software engineering student according to
researchers. Systematic methods are required to
facilitate the explanation of ethics. This kind of
methods are very appropriate for software
engineers in modeling the ethical decisions. Diagramming techniques includes such as
flowcharts and UML diagrams which seems to
be familiar approach for software engineers. [1]
.Poorly quality developed software increases the
chances of systems hacking.
System security is a
relevant topic for a software engineers practice.
It is the responsibility of the software engineer
to make the system secure which shouldn’t be
exploited. The software can only be hacked if it
has loop holes in the system that lead to
unauthorized access to data, applications,
networks or computer devices. [2] .Ethical
hackers are waged professionals who discover
loopholes in software to overcome the risk of
being hacked by black hat hackers. These are the
people who try to protect data while on the
internet with various attacks from hackers and
keep it safe with the owner.
Ethical hackers use
the same methods as black hat hackers but their
intention is to use their knowledge in a
productive way. Information obtained from
ethical hacking is used to maintain the security
of the system and to prevent system from further
potential attacks. [3]. As technology advances,
security threats and risks are increasing and due
to that fact Cybercriminals are becoming
increasingly more sophisticated with the ways in
which they exploit technology, making it
difficult to eliminate risks. Cyber-attacks can be
on technological infrastructure, in the form of
malware and viruses or on individuals according
to a study. Security ethical issue can be
mitigated by training programs and raising
awareness among the members of the
organization and end users of the software
according to scholars [4].
Ethical issues arises in
many areas of privacy, including surveillance,
medical privacy, Internet privacy and workplace
privacy. Making ethics effective in society plays
an important role in information security. The
ability to give people a set of ethical rules to
follow and provide an ethical conscience will
definitely establish a better layer of security in
organizations. Nowadays, information systems
are becoming large that it becomes more
difficult to manage with only technological
control mechanisms. Control mechanisms must
therefore be built on individual control
mechanisms which can be achieved by ethical
frameworks. While, the laws dictate what
behaviors we should follow while ethics
recommend what we should follow and it also
notable that for any good law, the law is based
on ethics. [5][8][9].
we categories hacking into
two ways, first is permissioned or ethical
hacking and second is illegal which is known as
reverse hacking. Security issue needs to be
considered during the development of the
software to find weakness in the system. Basic
principle of information security is strengthen
your Firewall. The firewall blocks the access to
the malicious and unsupported approach. It
creates a barrier between a trusted internal
networking and an unreliable external networks
just like internet. An intrusion detection system
is a hardware or software application .It is used
to monitor or control malicious activity on the
network. When a malicious activity occurs, an
administrator or safety information and event
management is reported. [6] The patch is a
backup of a computer program designed to
update, fix and improve it.
This includes
removing vulnerabilities and other defects and
these types of fixes are known to fix bugs. [6].
Ethics plays an important role in securing the
information systems. Social responsibility
means that every person is bound to behave in a
way that is not detrimental for the society. While
The illegal copying and distribution of
programs, music, videos and other form of
digital media is a major problem especially
among “Millennial” students, some of whom
may not have acquired digital media through
legitimate media these matters would consider
come under intellectual property and media
rights which point to the unethical behavior.
However universities need to introduce ethics
awareness and teach courses regarding ethical standard and provide training to the future
leaders of the development so they can apply
ethics in their profession while developing the
software [7].
InfoSec is a framework for
implementing socio ethical awareness which
will help organizations in spreading awareness
between all the staff and end users. This InfoSec
framework will contribute in establishing
awareness .Mainly in this era of advanced
technology, this framework’s has become
necessary to form standards of behavior for
client and companies. Individuals and
organizations that trade on the Internet should be
assured of their rights to privacy, the ownership
of their information and the responsibility to
ethically and properly control this
information.[9]
Methodology and Techniques Available
We are using back study approach in our paper. Firstly we will quickly look at the need of ethics in engineering then will describe the ethical issues including security, confidentiality and hacking and how they become ethical issues for software engineers. Finally we will discuss ways and techniques to mitigate these ethical issues.
Need of ethics in software Engineering
Software engineer has the power to do good and
bad to the society and that power must be used
to bring positivity and improvement in the lives
of the people. Taking decision according to
some standard is basically related to ethics.
Assuming that a recently graduated software
engineer has been hired to develop a software.
Without either assessing or testing the
framework appropriately, the recently hired
developer's boss pressurizes him/her to complete
the task rapidly. The board, as well, is very
much content with its quick turn of events and
offers the developed software to a few maternity
wards at emergency clinics nationwide.
The
abnormalities supported in the product, be that as it may, lead to the passing of a few babies.
The inquiry that emerges is that who is to be
considered responsible for these deaths? The
clinic heads being referred to have absolutely
procured the frameworks in accordance with
some honesty, particularly in the light of the fact
that they are no IT specialists in this field. The
developer in this situation is obviously help
responsible [8] .
This example demonstrates the
need of ethical awareness and responsibility.
So, firstly we are going to describe what
security, confidentiality and hacking is and how
these factors fall under ethical issues.
Security
Security is a condition of protection against danger or loss. In general, Security is a concept similar to safety. In the case of networks, security is also called information security and it points to the protection of data assets in case of breach of confidentiality. Information security means protecting information and information systems from unauthorized access, usage of data, discloser, interruption, alteration or destruction.
The Internet has increased the digitalization of various processes, such as online banking, online transaction, and transferring money over the internet, sending and receiving various forms of data over the internet which is increasing the security risks of data. Poorly quality developed software increases the chances of systems hacking. System security is a relevant topic for software engineer’s practice. It is the responsibility of the software engineer to make the system secure which is not easily exploitable. It becomes a moral problem for a software engineer when he cannot protect the security of the system. The software can only be hacked if it has loopholes in the system that lead to unauthorized access to data, applications, networks, or computer devices. In addition, information is accessed without permission.
Sometimes technical and technological measures are not sufficient to protect the origins of information. Additional measures should be used because there are many parameters when it comes to information security. One of these parameters is people. These people can be responsible for the system such as security professionals, employees, and users. These are the people who interact with the information system. To ensure that people are educated in the information system, a procedure that uses moral judgment must be entered. Computer and information ethics is studied by many researchers, academics, and professionals [1].
Including an ethical layer in information, security is very important because it can fill the gap which was created by those people. According to Kowalski, there are four significant explanations behind moral issues that appear in system or software security. To start with, there is a growing control gap in business data frameworks. The control gap can be additionally partitioned into three classes: Technological gap, socio-specialized gap, and social gap. What the truth and desires for the abilities of security implementing capacities is basically the technological gap. The socio-technical gap is the irregularity between socially-expected standards and security strategies while social gap points to people not acting as indicated by anticipated accepted practices Second, morals might be the regular language for the pros of various fields, and can be seen likewise by bunches outside the registering network. Third, current information systems are huge to the point that there are no verifiable mechanical control structures to oversee them. Rather, most frameworks are overseen by people’s understood control structures that are based on the system of ethical standards. Fourth, there is the requirement for top-down methodology, as to ISSI (Information
Systems Secure Interconnection) – model. As indicated by ISSI, five nontechnical layers are included as head of OSI conventions. The highest of these is the ethical layer that is a decent beginning stage to agree among clients and frameworks. Confidentiality refers to protecting information so that unauthorized people cannot access it. In other words, confidentiality data is only accessible to authorized persons. Failure to maintain confidentiality means that the person who should not be provided access has obtained it, through intentional behavior or by accident. In general, this breach of confidentiality, generally known as a breach that cannot be addressed. When the system is given access to an unauthorized parts, there is no way to detect it. Almost all of the major security accidents reported in the media today involve significant confidentiality losses. Because of the unauthorized access of confidential data to third party, it is ethical problem for the software engineer because he was responsible for maintaining the confidentiality of the data or information.
Hacking
Today all information is available online,
accessed by a large number of users, some of
them use this information to gain knowledge and
others use it to know how to use this information
to destroy or breach data and databases of
websites without the owner’s knowledge. As
computer technology advances, it also has its
dark side which is hacking. Today, a large
number of companies, institutions, banks and
websites are subject to different types of hacker
attacks by hackers.
Hacking is a method of finding loopholes or
vulnerabilities in computer system or networks
and using them to gain unauthorized access to
data or to change the characteristics of targeted
computer system or networks. Modifying computer, programs or networks to achieve
specific goal are terms of hacking that are
inconsistent with user goal. Hacker’s expertise
include software cracking as well as hardware.
A hacker is a computer enthusiast and highly
skilled in programming, security and
networking.
Hacking have two paths. The first one is legal
and authorized work while the other path is
illegal and unauthorized work. The authorized
advance is also known as certified engineering
.Illegal hacking is also called reverse
engineering .White hat hacking is legal job
assigned with the permission of organization
while Black and Grey hat hacking is not
approved.
According to the ways of working or according to their intension, Hackers can be classified into three groups.
- White Hat Hackers
- Black Hat Hackers
- Grey Hat Hackers
White Hat Hackers /Ethical Hacking
Ethical hacking is an information security
branch and also called as “Penetration testing”
or “White Hat hacking”. They are waged
professionals. To overcome the risk of being
hacked by hackers, we have ethical hacker in
this field, who are specialized in computer
security that violates and find loop holes in
protected networks or computer systems of some
organizations or companies and corrects them to
improve security working under set of rules and
regulations by various organizations. These are
the people who try to protect data while on the
internet with various attacks from hackers and
keep it safe with the owner. Ethical hackers use
the same approaches as black hat hackers but
their intention is to use their knowledge
productively. Information obtained from ethical hacking is used to maintain the security of the
system and to prevent system from further
potential attacks.
Ethical hacking is a useful tool for the industry.
Their expertise extends through penetration
studies, site security assessment, and secure
code reviews and security policy reviews.
Mark Abene, known worldwide for his
pseudonym Phiber Optik, information security
expert and entrepreneur. High level hacker were
in the 1980s and 1990s. He was one of the first
hackers to publicly discuss and defend the
positive benefits.
Need Of Ethical Hackers In software engineering:
Since each organization has its own confidential information that can be compromised or harmed by malicious hackers, therefore to protect this information, organizations employ ethical hackers and allow them to penetrate their systems ethically, find flaws or gaps in your systems and fix them before they hack your system. Ethical hacking is effective approach to overcome ethical problems in hacking
Black Hat Hackers
Cracker is the other name of Black hat Hackers.
Crackers are highly skilled programmer’s breaks
into someone system has malicious intent to
steal or destroy their important or confidential
information or compromise the security of some
institution, close or change the functions of sites
and networks. Crack system security for
personal gain is the main goal of cracker. These
people generally demonstrate their extensive
knowledge of computers and commit various
cybercrimes, such as identity theft, credit card
fraud etc.
Student used his hacking skills to hijack
webcams to catch young women pictures in
various stages of undress (Humphries 2008). [2] .So this act is considered as illegal hacking
which is highly unethical and affecting the lives
of the common people.
Grey Hat Hackers
A Gray Hat Hacker is a security expert who
frequently breach the law but has no malicious
intent such as the black hat hackers. The word
Gray Hat is obtained from Black Hat and White
Hat because white hat hackers or ethical hacker
discover weaknesses and loopholes in the
networks and computer system or and do not tell
anyone until it is fixed, while others hackers
apart from the black hat illegally hack the
computer system or the network to discover
loopholes and leak the information to the third
parties and the gray hat hacker does not illegally
hacks and does not tell anyone how to do it.
Gray Hat Hackers are amid white hat hackers
who manipulate to maintain the security of the
system and black hat hackers who hacks
maliciously to hacks computer systems.
Despite of their positive objectives, the gray hat
hacking can have upsetting social outcomes.
According to Reports of CNN reported in the
spring of 2015, Chris Roberts who is a
consultant for cybersecurity was detained after
supposedly illegally accessing the control
system of exceeding twenty united Commercial
airlines flights(Perez 2015).Although he profess
that his act was meant purely to aware people of
crucial security problems in the software of the
aircraft. It is not hard to perceive the negative
outcome that could rise if a malicious black hat
hacker attempted the similar action.
Ways to mitigate Ethical issues
We can overcome ethical issues using different
tools and techniques.
At first understanding of ethical is important
which can be explained by systematic methods
in an effective way. Moral standards needs to be
carried out without classification which come up as a foundation for morality. Systematic
methods are required to facilitate the explanation
of ethics. This kind of methods are very
appropriate for software engineers in modeling
the ethical decisions. Diagramming techniques
includes such as flowcharts and UML diagrams
which seems to be familiar approach for
software engineers.
Nowadays, information systems are becoming
large that it becomes more difficult to manage
with only technological control mechanisms.
Control mechanisms must therefore be built on
individual control mechanisms which can be
achieved by ethical frameworks. We can achieve
high and potent security by incorporating ethics
in control mechanisms.
Microsoft endured a break of security as for its
corporate system in October 2000 in which
important source code for a future item had been
obtained. The inquiry, accordingly, remains:
what are the full ramifications of that security
penetration for the association? Could Microsoft
be guaranteed that no endeavor had been made
to adjust the said item or to inspect it for some
type of trapdoor through which to dispatch
future security penetrates? Despite the fact that
they remain to a great extent unanswered, the
inquiries that emerge from the over two cases,
speculative and genuine, highlighting the need
of ethical information security awareness inside
the organization.
Societies of computer such as ACM have
recommended some professional practices and
code of ethics which an engineer must follow.
Ethics are tightly linked to legal procedures or
law if breached can leave an organization in
crisis. Community plays an important role in
information security by making ethical standards
productive. If ethical rules and standard are
given to individuals to follow and educating
them on ethics will definitely improve the
security layer in companies. Code of ethics
provide guidelines to individuals for interacting
with the system. They can be applicable to all
the people working in an organization including
developers, management, end users and security
experts. Organization can also specifically
develop code of ethics and apply them within
organization. This can be more useful and
efficient due to target and additionally it can fill
distinct security gaps related to information.
Kluge [9] has developed a code of conduct for
health information professionals. He discussed
various problems in the field of health
informatics and proposed a code of conduct for
various information security problems, he
suggested that in addition to the technical safety
layer in the health information system, there
should be an ethical layer that protect patient
private data. By creating this layer in health
information professionals.
One of these controls, Let us consider, can be
applied to intrusion detection systems, and is as
follows: Use of Surveillance System -
Unauthorized access attempts such as alerts
from proprietary intrusion detection systems,
access policy violations, network gateway
notifications and firewalls.
Consequently, ethics can need be applied within
groups which agree upon basic ethical standards
and acceptable conditions of use of information
systems. This responsibility can start from a
variety of factors. Agreement on common
standards for the functioning of systems at the
company level could be common business
interests. Individually, conditions of
employment or codes of ethics between the peer
groups can be the determining factor.
At the point when we talk about the ethics in
security, it must be taken into account when
developing software. Safety quality engineering
(SQUARE) is a process model gives a mean to
obtain, categorize and prioritize security
requirements for software system. The objective
of this methodology is to integrate security concepts during the early phases of the software
development life cycle (SDLC). The model can
also be used to document and analyze the
security side of systems put into service and
make improvement to software systems.
Awareness of security is an important factor in
securing the information of organization.
Numerous studies conducted confirms that lot of
computer users have insufficient knowledge of
information security. Government need to make
effort to provide awareness related to security so
that the people or users understand the threats
and risks in security. People working in an
organization are capable to make essential
security decisions at the need of hour, that’s why
employees should be provided proper training
and awareness to cope with this problem. Awareness should be including that what are the
security threats and how we can cope with these
threats. All users must be educated about
information security threats and understand their
responsibility in the process of security.
Security problem occurs when there are
weakness in the software which can be
controlled by reviewing the code. Code review
is an activity where the developers, coders and
testing team review the code in a group. The
weaknesses or loopholes in the software are
observed by the code review team which is
important before deployment of the software.
The software engineer is a professionally
responsible for the protection and confidentiality
of information / data. He should not disclose his
customers' personal data to unauthorized third
parties. He can only release the information if
that person has allowed it or it very necessary to
share the information.
Bases on moral theories, one techniques that can
be practically used to mitigate the issues of
hacking would be to focus on piloting the moral
and ethical concerns of gray hat hacking
scenarios through educational programs. Ethical
or white hat hackers still have the profound
Skills and capabilities as black hat hackers.
Basically, the laws dictate what behaviors we
should follow while ethics recommend what we
should follow and it also notable that for any
good law, the law is based on ethics. Laws are
enacted to protect the people who are innocent
from the harm to boost rights. There are some
laws related to hacking, if the laws are applied
properly, hacking ethical issues can be mitigated
to some extent. The law punishes hacking under
the computer crime statutes.
Internationally, countries have started legalizing
diverse laws and rules against hackers to protect
people and organizations from reverse
engineering attacks and other related crimes to
hacking. Unfortunately, obedience to the law is
the main exceptionally criminal component in IT
security that prompted its initiation in any case.
Individuals' have to recognize what their
privileges are and the discipline to be imposed if
they somehow happened to violate law.
Along these lines, the UK Computer Misuse Act
of 1990 ensures against all PC abuse offenses by
securing against unapproved access to PC
material; unapproved access with aim to submit
or encourage commission of further offenses and
unapproved alteration of data/information.
The computer fraud and Abuses act is the main
/important law against hacking that prohibits
illegitimate access to third party or some other
system.
Though the law was primarily intended
to protect the computer systems of U.S.
government entities and financial institutions,
the extent of the law has extended with changes
to include virtually all computers in the country
(containing devices such as servers, laptops,
smartphones desktops and tablets).
Civil Violations under the CFAA is the law to
penalize the criminals who violates the law. But
the modification made in 1994 expanded the act
to take in the causes of action for to take in the causes of action for civil suits as
well as to criminal prosecution. Violation in this
act included the following clauses: attaining data
from a computer through illegitimate means,
Trafficking in a computer password that can be
used to get access to a computer; spreading
spam and harming the data or information stored
on computer.
Professional software engineers are aware of the
fact that security considerations must be taken
into account in the design and during the
complete software development life cycle. Their
security skills can be further strengthened by
developing additional skills in hacking
approaches while inspecting ethical reasoning to
completely understand the dividing line between
white hat and gray hat hacking circumstances.
IV. Proposed Methodology:
1. Research Design
This is a quantitative research which used a quantitative method and it uses different measurements scales. The aim was to get opinions of software engineering students and professional about Overview of Ethical Issues such as security, confidentiality and Hacking in Software Engineering .We have used google forms for conducting a survey.2. Data Collection Technique
The primary data was collected using a questionnaire. Questionnaire method has been followed to collect the data from the respondents. Questionnaire contains eleven question created on google form which was filled by software engineering students and IT professionals. The information is kept confidential. This study uses a 3 Liker scale. Questionnaire was filled by thirty respondents out of which 63.3 are female and 36.7% male respondents. If we talk about the occupational status of the respondents, 56.7% are undergraduate students of software engineering and 43.3 % are IT professionals.