Ethics in Cybersecurity

If you scroll through the headlines in cybersecurity, you will often see topics that grab the readers’ attention. Correct me if I am wrong, but you’ve probably read a lot about State-sponsored APT attacks, ransomware, bug bounty programs, disclosure of 0Days, zero day usage, what color hat a hacker is. While I could go on with topics, I think that we are on the same page. One of the things that we often don’t discuss when it comes to this topic is what is and what is NOT ethical. Subscribers to the Kaspersky Transatlantic Cable podcast may remember that this was a topic that David and I tapped into with Ivan Kwiatkowski discussed on a podcast a few weeks ago. Over the past few months, Ivan and I have been discussing this quite regularly and decided to hop into the topic in some more depth. After crossing all the T’s and dotting the I’s with our internal stakeholders, we were able to pull together a crew to discuss and debate some of the topics that play into this space. Our guests included my usual co-host David Buxton, Aseel Kayal and Runa Sandvik – make sure to follow these folks on the Twitter. During our near 2-hour conversation, we discuss a wide ranging of topics, including: • Competetive collaboration between infosec vendors • Disclosure • Role of government and private companies for user security • Attribution • Does threat intelligence help adversaries? • Governments hoarding 0days There is much more in there and will definitely help pique the interest of anyone working within the space.