The (ISC)² Ethics Committee helped provide this overview of professionalism, ethics, the (ISC)² Code of Ethics and case studies to help explain the ethics complaint & review process. Co-developed with William H. Murray, Graham Jackon & Mano Paul.

1. This Curious Thing
Called Ethics
William H. Murray CISSP
Dan Houser CISSP-ISSAP
Graham Jackson, JD
Mano Paul CSSLP

2. I am a Professional
•
Professional education.
•
Professional experience.
•
Professional work requiring special intellectual attainment and
discipline.
•
Share a body of professional knowledge with my colleagues.
•
Subscribe to ethical principles, behave in an ethical way, and set a
good example.
•
Responsibility to the common good, my clients, and my profession
ahead of personal interests.
•
Sign my work and take responsibility for the work of my
subordinates, colleagues, and associates.

3. I am a Security Professional
•
Special authority, responsibilities, and duties
•
Must not give unwarranted comfort or to raise
unnecessary alarm
•
Use privileges and capabilities as intended.
•
Professionals owe a duty of confidentiality
•
As a security professional, have a particular duty to
preserve the confidentiality of my principals' data.
I must not disclose it to others, including
government authorities, without their permission.

4. I am a CISSP
•
Subscribed to the Code of Ethics
•
Public good even ahead of those to my principals, those to
my principals ahead of those to my colleagues, and all of
those ahead of my own interests.
•
As a member of (ISC)² I can refer to the ethical guidance on
our web site to help me determine the greater of goods or
the lesser of evils.
•
If my principal fails to take my advice or engages in illegal
activity, I must take a walk and maintain my silence.
•
When all else fails me, I can consult with other professionals.

5. Controls
•
Application Review
•
Endorsements
•
Committee review
•
Complaint Procedure
•
Committee Recommendation
•
Appeal

6. Your Responsibility
•
Subscribe to the Code
•
Familiarize yourself with the guidance
•
Resolve dilemmas (greater of goods, lesser of
evils)
•
Consult with and support your colleagues
•
Professional Development
•
Review and endorse Applications
•
Report violations

7. Case Study 1
Amanda, a CSSLP, files a compliant. Brian, a
CISSP, is an independent consultant, and was
retained to perform a network and system
assessment to PCI-DSS standards. Amanda
states that the work was slipshod and did not
appropriately reflect the standards. Amanda
asserts that the work did not demonstrate an
ethical amount of due care.

8. Case Study 1a
Amanda provides further documents showing 3
signatures on compliance documents that she
states were forged, and that the signatures do
not match those of the principals. When
contacted, Brian states that he received verbal
permission to sign the documents on their
behalf to meet an urgent filing deadline, so he
forged the three signatures.

9. Case Study 2
Cindy is a student in a CSSLP curriculum who is
caught by campus security, having compromised
the security of some of her school’s servers. The
school states this was without notice or
permission. Cindy states that she was
conducting a pen test for a science fair project
on network security. She has documents
showing her plan, but no documents providing
permission.

10. Case Study 2a
Cindy provides documentation from her teacher
that they were to have arranged for a scope of
effort document and permission letter from the
school. Cindy started her scan as scheduled, but
did not wait for the letter and permission.

11. Case Study 3
Daryl is a CISSP who has self-published a general
security book. Emily files a complaint, and
shows that Daryl had copied 12 pages, verbatim,
from a book she had published two years prior.
Emily shows that the text contained no
attribution.

12. Case Study 3a
Daryl responds to the allegations showing that
the text had attribution as an endnote and was
listed in the forward of the book and the
bibliography.

13. Case Study 4
Frank is a CISSP who has conducted a certification &
accreditation assessment for a new system and
documented 40 high risk issues in the certification
report. After signoff on the certification report, one of
certifiers modifies the document, moving most “high
risk” issues to show them as “resolved”. It is the
modified version which is used for accreditation
signoff.

14. Case Study 4a
Frank takes the original and changed documents to the
InfoSec VP, a CISSP, who does not want to “make
waves”, and the issue goes unchallenged.
Frank takes the issue to the Ethics & Compliance
Hotline, and they decline to take up the case because
it’s not concerning customer data.
Frank has signed an NDA, and audit results are
classified as Company Confidential.

15. Bill Murray
email
Dan Houser
dan.houser@isc2.org
@SecWonk
Graham Jackson
gjackson@isc2.org
Mano Paul
email