A Care-Based Stakeholder Approach to Ethics of Cybersecurity in Business

Abstract

This chapter focuses on ethical issues in cybersecurity in business. It first sketches the main ethical issues discussed in the academic literature thus far. Next, it identifies some important topics that have not yet received the attention they deserve. The chapter then focuses on one of those topics, ransomware attacks, one of the most prevalent cybersecurity threats to businesses today. It provides a brief overview of the main types of ransomware attacks and discusses businesses' responsibilities to their stakeholders to respond to them. Daniel Engster's care-based stakeholder approach is used to assess the responsibilities that businesses have to their stakeholders. The analysis involves establishing who counts as a stakeholder when a ransomware attack occurs and what the stakeholders' interests might be. Based on stakeholders' interests, the analysis concludes on whether businesses have an ethical responsibility to their stakeholders to (1) respond to grey hat demands by patching identified vulnerabilities within the given timeframe and (2) respond to black hat demands by paying the ransom.Due to the uptake of information and communication technology (ICT) in the business sector, the value of information has increased. Information is now considered the new oil and as oil brought both prosperity and problems, so too does information. Prosperity emanates from the fact that businesses can utilise ICT to reduce costs and increase efficiency by providing round-the-clock availability of both information and services to customers. In providing that availability, problems arise. If information is constantly available, this means that it is constantly vulnerable to an attack. This trade-off between providing availability and securing

A Discussion on Ethical Cybersecurity Issues in Digital Service Chains

“…The methodology follows the privacy framework of Nissenbaum [68] that views privacy as contextual integrity and extends it with "social norms and expectations affecting all human interactions that are constitutive of an established social practice" [50]. When discussing ethical issues in the context of business, the book focuses more on specific domains, such as healthcare, or on ensuring cybersecurity for businesses (see [59,80]).…”

A principlist framework for cybersecurity ethics

“…The Menlo Report (2012) 1) respect for persons, 2) beneficence, and 3) justice Loi and Christen (2020) 1) privacy, 2) data protection, 3) non-discrimination, 4) due process and free speech, and 5) physical integrity Weber and Kleine (2020) 1) efficiency and quality of service, 2) privacy of information and confidentiality of communication, 3) usability of services, and 4) safety. Morgan and Gordijn (2020) 1) privacy, 2) protection of data, 3) trust, 4) control, 5) accountability, 6) confidentiality, 7) responsibility on business to use ethical codes of conduct, 8) data integrity, 9) consent, 10) transparency, 11) availability, 12) accountability, 13) autonomy, 14) ownership, and 15) usability.…”

“…An alternative approach to incorporating privacy is to include it as a separate ethical principle that attempts to incorporate the diversity of definitions noted above (e.g., Van de Poel, 2020 ;Loi and Christen, 2020 ;Morgan and Gordijn, 2020 ). While such an approach might more accurately reflect the multifaceted character of privacy, it perpetuates principle proliferation by ignoring the conceptual relationships between privacy and existing principles as summarised within Table 2 .…”

“…Ransomware attacks are becoming more common, with one study claiming that they had tripled between 2017 and 2018 ( Morgan and Gordijn, 2020 ). WannaCry and Petya are two prominent recent ransomware attacks, with the former hitting the British NHS which resulted in cancelled medical appointments and diverted ambulances ( Hern, 2017 ).…”

“…WannaCry and Petya are two prominent recent ransomware attacks, with the former hitting the British NHS which resulted in cancelled medical appointments and diverted ambulances ( Hern, 2017 ). Ransomware works by either encrypting data (cryptors) or blocking access to data (blockers) with the intention of extracting financial gains ( Morgan and Gordijn, 2020 ). Typically, this outcome is achieved by offering to unencrypt or provide access to the data in exchange for the payment of a ransom.…”