* Approaching security policy with ethics in mind
Norwich University graduate student Steven Lovaas recently published an award-winning essay on the importance of ethical considerations in security policy development and implementation.
Lovaas begins by pointing out, “Each of the three phases of policy implementation – development, dissemination and enforcement – should be examined to be sure that stakeholders are treated ethically while protecting the information assets critical to the ongoing viability of the organization.”
During policy development, security managers must recognize that employees may differ in their moral standards. People differ in their degree of sophistication of moral reasoning and they also differ in assumptions.
For example, says Lovaas, “some employees may believe that [cyberspace] is a different place with its own rules… and may feel no moral compunction about illegal downloading of music files, even though they would never steal a CD from a music store. Some may even espouse a completely different ethical system… in which the free dispersal of information is far more important than societal protection of the fruits of labor.”
The implications of this diversity are that every organization should make the standards for its security rules completely explicit. Employees should not have to guess why a rule has been promulgated.
In addition, security policies should emphasize the benefits both to the organization and to the individual of having and complying with policies. Organizational structures should include means for stakeholders to communicate their objections to policies and their suggestions for improvement. Objections should be handled respectfully and rationally. Lovaas summarizes several practical approaches to gaining consensus on disputed policies.
Lovaas completed his Master of Science in Information Assurance degree at Norwich in June and will be an Adjunct Professor of Information Assurance at Norwich later this year. Congratulations to him for a fine piece of writing.
