Fluent Essays

chapter 6 Tavani Ethics and Technology BookSummarize the entire chapters readingPlus some analysis a particular idea you choose from the reading and I also want you to connected to some example.I will attach you the book and the Rubtic below ethics_and_technology__controversies__questions__and_strategies_for_ethical_computing__4th_edition.pdf reading_response_rubric.pdf Unformatted Attachment Preview C063GXML 10/19/2012 22:16:33 Page 174 c CHAPTER 6 Security in Cyberspace Can cyber intrusions (including cyberattacks and computer break-ins) ever be justified on ethical grounds? This is one of many cybersecurity issues that we will examine in Chapter 6. Other questions include the following:
What is cybersecurity, and how are security issues involving computers and cybertechnology different from privacy issues in cyberspace?
How are violations involving cybersecurity similar to and different from issues of cybercrime?
Which key features differentiate data security, system security, and network security?
What is “cloud computing,” and which kinds of challenges does it pose for cybersecurity?
What is meant by “hacking” and the “hacker ethic”?
Can a clear distinction be drawn between “hacktivism” and cyberterrorism?
What is the difference between cyberterrorism and information warfare (IW)? We begin our analysis of security issues in cyberspace with a brief discussion of some basic concepts and definitions. c 6.1 SECURITY IN THE CONTEXT OF CYBERTECHNOLOGY What, exactly, do we mean by “computer security” and “cybersecurity”? Like privacy, security—especially, in the context of computing and cybertechnology—has no universally agreed-upon definition. The expressions computer security and cybersecurity are often associated with issues having to do with the reliability, availability, and safety, of computers systems, as well as with the integrity, confidentiality, and protection of data. Richard Epstein (2007) suggests that security concerns affecting computers and cybertechnology can be viewed in terms of three key elements:
confidentiality,
integrity,
accessibility. 174 C063GXML 10/19/2012 22:16:33 Page 175 6.1 Security in the Context of Cybertechnology b 175 Whereas confidentiality is “about preventing unauthorized persons from gaining access to unauthorized information,” integrity, in computer security contexts, is about “preventing an attacker from modifying data.” In Epstein’s scheme, accessibility has to do with “making sure that resources are available for authorized users.”1 Are any additional elements or criteria useful for understanding cybersecurity? Peter Neumann (2004) notes that, in addition to providing desired confidentiality, integrity, and accessibility, cybersecurity aims at preventing “misuse, accidents, and malfunctions” with respect to computer systems. Neumann also notes, however, that cybersecurity can be a “double-edged sword”; for example, it can be used to protect privacy, but it can also be used to undermine “freedom of access” to information for users.2 In defining cybersecurity, it is important to point out that sometimes issues involving security in cyberspace overlap with concerns pertaining to cybercrime; other times they intersect with issues involving privacy. We briefly examine some ways in which security issues intersect and overlap with both kinds of concerns, also noting how security concerns can be distinguished from those of privacy and crime. 6.1.1 Cybersecurity as Related to Cybercrime How are cybersecurity violations both similar to and different from cybercrime? First, we should note that some cyberethics textbooks link together issues involving cybersecurity and cybercrime by covering them in the same chapter. Consequently, these issues could easily be viewed as subcategories of a single cyberethics category. But while most intentional cybersecurity violations are illegal and often criminal, not every crime in cyberspace involves a breach, or violation, of cybersecurity. Consider three cyber-related crimes that have no direct implications for cybersecurity: a pedophile can use a computer to solicit sex with young children, a drug dealer can use the Internet to traffic in drugs, and a student can use an electronic device to pirate copyrighted music. Although each of these activities is clearly illegal, it is not clear that any of them necessarily result from insecure computers. Perhaps greater security mechanisms on computer networks could deter crimes and detect criminals in cyberspace, but cyber-assisted crimes involving pedophilia, drug trafficking, and pirating music do not typically result from security flaws in computer system design. There are, then, important distinctions between issues of security and crime involving cybertechnology. We will discuss cybercrime in Chapter 7, and focus our attention in this chapter on actual and potential threats to security in cyberspace. Just as cybersecurity issues are sometimes lumped together with cybercrime, security concerns involving cybertechnology can also overlap with worries about personal privacy. We briefly considered some of these privacy-related security concerns in our discussion of PETs in Chapter 5. Now we ask: How are issues pertaining to security in cyberspace different from those involving privacy? 6.1.2 Security and Privacy: Some Similarities and Some Differences The concepts of privacy and security are not always easy to separate, especially when civil liberties and basic human rights are discussed. In the United States, arguments for a right to privacy that appeal to the Fourth Amendment have often been made on the basis of securing the person (and the person’s papers, and so forth) from the physical intrusion of searches and seizures. Paul Thompson (2001) believes that many of our claims involving a C063GXML 10/19/2012 22:16:33 Page 176 176 c Chapter 6. Security in Cyberspace right to privacy are grounded in the notion of security and can be better understood as arguments concerning a “right to being secure.” Although cyber-related issues involving privacy and security can overlap, some important distinctions are nonetheless worth drawing. Privacy concerns affecting cybertechnology often arise because people fear losing control over personal information that can be accessed by organizations (especially businesses and government agencies), many of whom claim to have some legitimate need for that information in order to make important decisions. Security concerns, on the contrary, can arise because people worry that personal data or proprietary information, or both, could be retrieved and possibly altered, by unauthorized individuals and organizations. Privacy and security concerns can be thought of as two sides of a single coin: People need personal privacy and they wish to control those who have information about them as well as how that information is accessed by others. Making sure that personal information stored in computer databases is secure is important in helping them achieve and maintain their privacy. In this sense, then, the objectives would seem compatible with, and even complementary to, security. In another sense, however, there is a certain tension between privacy and security. From the perspective of security, the protection of system resources and proprietary data is generally considered more critical, whereas from the vantage point of privacy, the protection of personal information and personal autonomy will receive a higher priority. In analyzing the tension involving privacy vs. security interests, Kenneth Himma (2007a) has argued that threats to security outweigh comparable threats to the right to privacy. On the contrary, Helen Nissenbaum (2010) offers a more sympathetic appeal to the value of privacy in her analysis of the trade-offs between the two competing interests. The following quotation, attributed to Ben Franklin (1706–1790), is sometimes cited by privacy advocates to express their interpretation of what is at stake in the dispute involving security vs. privacy interests: “They who can give up essential liberty to obtain a little temporary safety, deserve neither liberty nor safety.” However, in an era where concerns about cyberterrorism now influence our public policy debate, many people may be more willing to give up aspects of their liberty and privacy for greater security. (We examine some impacts that cyberterrorism has for this debate in Section 6.5.) In the context of cybersecurity, privacy-related concerns include protecting personal data from unauthorized access, abuse, and alteration, and thus reflect values that preserve individual autonomy and individual respect for persons. And while anonymity tools (briefly described in Chapter 5) help to protect the privacy of individuals navigating in cyberspace, those tools can also cause serious concerns for security because anonymous behavior makes it difficult to identify security violators. So, in some cases, there is a natural tension between security and privacy, as we have seen; at other times, however, the objectives and goals of privacy and security—for example, with respect to confidentiality and data integrity—are the same.3 c 6.2 THREE CATEGORIES OF CYBERSECURITY Security issues involving cybertechnology span a range of concerns having to do with three distinct kinds of vulnerabilities: I. Unauthorized access to data, which are either resident in or exchanged between computer systems. C063GXML 10/19/2012 22:16:33 Page 177 6.2 Three Categories of Cybersecurity b 177 Computer Security Data Security Securing data that resides in computer databases Securing data that is transmitted between computer systems System Security Securing hardware and operating system resources Securing application software and programs Network Security Securing the infrastructure of privately owned networks Securing the infrastructure of the Internet Figure 6.1 Three kinds of computer security. II. Attacks on system resources (such as computer hardware, operating system software, and application software) by malicious computer programs. III. Attacks on computer networks, including the infrastructure of privately owned networks and the Internet itself.4 We refer to the first of these three categories of security concerns as “data security.” The second category of concerns can be described under the heading “system security,” and the third can be understood as “network security.” We briefly describe some key aspects of each category of security, as summarized in Figure 6.1. 6.2.1 Data Security: Confidentiality, Integrity, and Availability of Information Data security is concerned with vulnerabilities pertaining to unauthorized access to data. Those data can either (a) reside in one or more computer storage devices or (b) be exchanged between two or more computer systems, or both. In particular, data security issues affect the confidentiality, integrity, and availability of information. Richard Spinello (2000) aptly describes what is required for data security when he points out that . . . proprietary or sensitive information under one’s custodial care is kept confidential and secure, that information being transmitted is not altered in form or content and cannot be read by unauthorized parties, and that all information being disseminated or otherwise made accessible through Web sites and online data repositories is as accurate and reliable as possible.5 Three points in this description are worth highlighting. First, the information to be protected can be either proprietary or sensitive, or both. (Proprietary information, as we will see in Chapter 8, is legally protected by schemes such as copyrights and patents and thus can be “owned” by corporations or by individuals, while sensitive information is generally considered to be intimate or confidential because it includes personal, medical, and financial records.) C063GXML 10/19/2012 22:16:33 Page 178 178 c Chapter 6. Security in Cyberspace Second, the information must be secured not only from tampering and alteration by unauthorized parties but also from merely being accessed (and read) by those parties. Third, and finally, the stored information must be accurate, readily available, and accessible to authorized parties. So, not only must the information residing in a computer database or in a password-protected Web site be available at optimal times, it must be able to be accessed by authorized users at any time—i.e., accessible “on demand.” Data security is now also threatened by “cloud-computing” services, as more and more corporations and ordinary users elect to store their data in “the Cloud.” Cloud storage devices provide users with one means to secure their data by ensuring that their data could survive (a) “crashes” on the hard drives of their personal computers, and (b) physical damages involving their electronic “tablets” and electronic devices. However, cloud storage also poses a threat to data security because unauthorized users could gain access to, and potentially manipulate, personal data that is stored there. We examine cloud computing in detail in Section 6.3. 6.2.2 System Security: Viruses, Worms, and Malware System security is concerned with vulnerabilities to system resources such as computer hardware, operating system software, and application software. As such, it is concerned with various kinds of viruses, worms, and related “malicious programs” that can disrupt and sometimes destroy computer systems. What are the differences between computer viruses and worms? According to Ed Skoudis (2004), a virus is a self-replicating piece of software code that “attaches itself to other programs and usually requires human action to propagate.” He defines a worm in contrast as a self-replicating piece of code that “spreads via networks and usually doesn’t require human interaction to propagate.” Michael Simpson (2006) points out that worms replicate and propagate without needing a host or program. Some security analysts differentiate further between the two types of disruptive programs by pointing out that a worm is less virulent than a virus. However, worms can spread more quickly than viruses, because worms, unlike viruses, do not need any human action to trigger them. We already noted that viruses cannot run on their own and are often activated when an unsuspecting user opens an e-mail attachment. Worms, on the contrary, can move from machine to machine across networks and can have parts of themselves running on different machines. The following scenario describes some effects of one notorious worm. c SCENARIO 6–1: The Conficker Worm In 2009, the Conficker Worm—also referred to as Kido, Downup, and Downadup—gained international attention. The worm spread quickly via a vulnerability described as a “buffer overflow” in the Microsoft Windows operating system. Later versions of Conficker also spread through both network file systems and USB drives. George Lawton (2009) notes that the worm turned the computers it infected into “a botnet capable of launching mass attacks” and that in a 4-day period in January 2009, the number of “individual infections grew from 2.4 to 8.9 million.” Among the international organizations affected by Conficker were the German armed forces and the U.K. Ministry of Defense.6 & C063GXML 10/19/2012 22:16:34 Page 179 6.2 Three Categories of Cybersecurity b 179 Other worms and viruses have also become well known—not only in the computer community but in the popular media as well. For example, you may have heard of the ILOVEYOU virus (also known as the “Love Bug”) that wreaked havoc for computer users around the world in 2000. Other classic viruses and worms have had names such as “Blaster, “Slammer,” and “Code Red.”7 (In our analysis of information warfare in Section 6.6, we examine some controversies involving the Stuxnet worm and the Flame virus, which generated controversy when they were exposed in June 2012 in connection with cyberattacks on Iran.) If the distinction between viruses and worms were not confusing enough, some analysts suggest that we further differentiate disruptive programs to include Trojan horses and logic bombs. A Trojan horse often appears to be a benign program, but it can do significant system damage behind the scenes. Logic bombs, on the contrary, check for certain conditions or states in a computer system and then execute when one of those conditions arises. Some now refer collectively to these various kinds of “malicious programs,” including viruses and worms, under the single heading “malware.” Simpson (2006) notes that malware can take many forms and can also include “spyware.” The effects of malware can range from minor annoyances with individual computer systems, to preventing an entire organization from operating, to shutting down computer networks, to disrupting major segments of the Internet. 6.2.3 Network Security: Protecting our Infrastructure A third category of computer security, which we call network security, is concerned with securing computer networks—i.e., from privately owned computer networks (such as LANs and WANs) to the Internet itself—against various kinds of attacks. The Internet’s infrastructure has been the victim of several attacks. These attacks have ranged from programs launched by individuals with malicious intentions to individuals who claimed their intentions were benign. In many cases, these attacks have severely disrupted activities on segments of the Internet. In a few cases, they have also rendered the Internet virtually inoperable. We should note that it is not always easy to determine whether a major computer network disruption is the result of the work of malicious individuals who launch various kinds of malware or is due to the failure of some aspect of the network infrastructure itself. For example, a significant power outage experienced by the AT&T long distance telephone service in 1990 was attributed to a software glitch in the system’s programming code that caused the network to crash. However, some have questioned the official explanation given by AT&T, suggesting instead that the crash may have resulted from an attack involving malware. Because many nations now depend on a secure cyberspace for their physical infrastructures, including power grids, there has been increased concern over threats from international hacking groups, including governments and state-sponsored organizations. The following scenario illustrates how vulnerable our national infrastructure may be to attacks by foreign governments. c SCENARIO 6–2: The GhostNet Controversy In 2009, The Information Warfare Monitor (IWM), a Canadian organization that monitors cyberespionage, discovered a network of at least 1,295 compromised computers in 103 countries. Approximately 30\% of these were considered “high-value” targets, which (according to the IWM C063GXML 10/19/2012 22:16:34 Page 180 180 c Chapter 6. Security in Cyberspace TABLE 6.1 Data, System, and Network Security Cybersecurity Category Data security System security Network security Corresponding Area(s) of Concern Concerned with vulnerabilities pertaining to unauthorized access to data, as well as with threats to the confidentiality, integrity, and availability of data that resides in computer storage devices or is exchanged between computer systems. Concerned with attacks on system resources (such as computer hardware, operating system software, and application software) by malicious programs. Concerned with attacks on computer networks, including the infrastructure of privately owned networks as well as the Internet itself. Report) included ministries of foreign affairs, embassies, international organizations, news media, and nongovernmental organizations (NGOs). The computer systems were compromised in ways that suggested China was responsible, but the IWM report refused to identify any one nation. The circumstantial evidence implicating China was tied to the fact that IWM’s investigation was launched in response to a request by the Dali Lama, the exiled leader of Tib ... Purchase answer to see full attachment