Merry Christmas and a Happy New Year

Professional Ethics and Responsibility

According to Deborah Johnson (2008), the distinction between “guns-for-hire” and professionals is the fact that “guns for hire” will do everything in his or her capabilities for the prices. By contract, a professional will take responsibility for his or her action.
In an ideal world, every professional adheres to a core set of values of the profession. Ethical values include a value of human life in medicine, accuracy in auditing, integrity (among the others) in military and safety in engineering. Number of computer ethics bodies published and maintain code of ethics and conduct such as BCS, ACM and IEEE but due to variability in computing field it is difficult to define ethical behaviour of computing professional.
Since so many non-experts rely on a computer professional expertize, it puts the computer professional in a position of power. Furthermore, the result of a work conducted by a computer expert has direct and indirect impact on users of the product. “Computer experts generally work either as employees in organizations (including corporations, government agencies, and nongovernmental organizations) or as consultants hired to perform work for clients. Often their employer or client does not have the expertise to understand or evaluate the work being performed” Deborah Johnson (2008).
When we consider a role of a company (employer) and the impact of corporate policy and goals on a computer expert, the equation becomes even more complicated. Debora Johnson (2008) explains that “a computer experts might think of themselves as merely agents. They might presume that their client, employer, or supervisor is in charge and the expert’s role is merely to implement the decisions made by those higher up”. Furthermore, the role of a computer expert has a direct impact on the way an organization conducts business. Certain roles pf a computer professional could have conflicting interests with the business goals. For example, a security consultant should accurately identify security vulnerabilities and provide objective (vendor neutral) recommends without being compensated for up-selling a service or a hardware solution.
Debora Johnson (2008) summarizes that “computer experts aren’t just building and manipulating hardware, software, and code; they are building systems that help to achieve important social functions, systems that constitute social arrangements, relationships, institutions, and values.”

Bibliography

• Association for Computing Machinery (1992), ACM Code of Ethics and Professional Conduct [online]. Available from: http://www.acm.org/about/code-of-ethics (accessed December 5, 2010).
  
• British Computing Society (2006), Code of Conduct [online]. Available from: http://www.bcs.org/server.php?show=nav.6030 (accessed December 5, 2010).
  
• Johnson, Deborah G. 2008. "Computing Ethics Computer Experts: Guns-for-Hire or Professionals?." Communications of the ACM 51, no. 10: 24-26. Business Source Premier, EBSCOhost (accessed December 5, 2010).
  
• IEEE (2006), IEEE Code of Ethics [online]. Available from: http://www.ieee.org/membership_services/membership/ethics_code.html (accessed December 5, 2010).
  

Whose Responsibility is it Anyway?

Yesterday, SC Magazine published an article about PCI DSS compliance responsibility (http://www.scmagazineuk.com/Whose-responsibility-for-compliance-is-it-anyway/article/146476/) which I found very amusing. Why? Well, how come when you give something that is dear to you, you don't consider whom you give it to?

From a user prospective, if you don't think twice before you give away your private information, you have no one to blame but yourself. As a merchant or a service provider, you need to make sure that information that was given to you by the end user stays secure throughout data lifecycle and if you share it, it has to be someone who can provide at least the same level of security as you do.

PCI DSS requirement 12.8 is there to enforce that. Right now, merchant and/or service provider is not required to use only PCI DSS certified service providers but it is their responsibility to maintain a register of all third parties that have access to cardholder data, to have a proper contract in place (which includes acknowledgement by the third party of their responsibility for securing cardholder data) and review the associated risk regularly.