Week 09

Week 09 — Database Security

Learning Objectives
After these classes, students will be able to:

 Understand what database security is and why it is important

 Identify common database threats
 Apply basic protection methods
 Understand access control and backup concepts
 Discuss ethical and professional responsibilities related to data

Introduction to Database Security

1. What is Database Security?

Database security means protecting data stored in databases from:

 Unauthorized access
 Data theft
 Data modification
 Data loss

Databases store important information, such as:

 Student records
 Bank accounts
 Hospital data
 Company information

If this data is leaked or changed, it can cause financial loss, legal problems, and
loss of trust.

2. Why Database Security is Important

 Week 09

Database security helps to maintain:

 Confidentiality – Only authorized users can see data

 Integrity – Data remains correct and unchanged
 Availability – Data is available when needed

These three are called the CIA Triad.

3. Common Database Threats

Some common threats are:

 SQL Injection – attacker inserts harmful SQL commands

 Unauthorized access – weak passwords or stolen accounts
 Insider threats – employees misusing access
 Malware attacks
 Hardware failure

4. Ethical Aspect

Must understand:

 Data belongs to people

 Misuse of data is unethical
 Professionals must respect privacy

Access Control and Authentication

1. Authentication

Authentication means verifying user identity.

Common methods:

 Username and password

 OTP (One Time Password)
 Week 09

 Biometric (fingerprint, face scan)

Strong passwords should:

 Be long
 Include numbers and symbols
 Not be shared

2. Authorization (Access Control)

Authorization decides what a user can do.

Types of access:

 Read
 Write
 Update
 Delete

Models:

 Role-Based Access Control (RBAC) – permissions based on job role

 Least Privilege Principle – give only necessary access

3. Database Auditing

Auditing keeps records of:

 Who accessed the database

 What changes were made
 When actions occurred

This helps in:

 Detecting misuse
 Legal investigations
 Improving security policies
 Week 09

Backup, Encryption, and Risk Management

1. Database Backup

Backup means making copies of data.

Types:

 Full backup
 Incremental backup

Importance:

 Protects against data loss

 Helps recover after cyber attacks

2. Encryption

Encryption converts data into unreadable form.

Used for:

 Stored data
 Data sent over networks

Only authorized users can decrypt it.

3. Risk Management

Steps:

1. Identify risks
2. Analyze impact
3. Apply controls
4. Monitor regularly
 Week 09

Examples:

 Use firewalls
 Apply patches
 Train staff

4. Professional Responsibility

 Follow security policies

 Respect user privacy
 Report vulnerabilities
 Week 10

Week 10 — Network Security

Learning Objectives
Students will be able to:

 Understand basic network security concepts

 Identify network attacks
 Use protection tools
 Analyze security problems
 Discuss legal and ethical issues

Introduction to Network Security

1. What is Network Security?

Network security protects data traveling across networks.

It prevents:

 Hacking
 Eavesdropping
 Data tampering

2. Common Network Threats

 Virus and worms

 Week 10

 Man-in-the-middle attack
 Denial of Service (DoS)
 Phishing

3. Security Goals

 Confidentiality
 Integrity
 Availability

Same CIA principles apply to networks.

Network Protection Tools

1. Firewalls

Firewall is a security wall between internal and external networks.

It:

 Blocks unwanted traffic

 Allows trusted traffic

2. Intrusion Detection System (IDS)

IDS monitors network activity.

It:

 Detects suspicious behavior

 Sends alerts

3. Antivirus and Anti-malware

These tools:
 Week 10

 Scan files
 Remove harmful programs
 Protect endpoints

4. Secure Communication

Use:

 HTTPS
 VPN

These encrypt data during transfer.

Network Policies, Risk & Ethics

1. Security Policies

Rules for users, such as:

 No sharing passwords
 No unknown USB devices
 Regular updates

2. Network Risk Assessment

Steps:

 Identify vulnerabilities
 Evaluate threats
 Apply controls

Examples:
 Week 10

 Change default passwords

 Disable unused ports

3. Cyber Ethics

Must understand:

 Hacking without permission is illegal

 Privacy must be respected
 Data misuse is a crime

4. Real-Life Applications

Network security is used in:

 Banks
 Universities
 Hospitals
 Government systems
 Week 11

Week 11 — Software Security,

Vulnerabilities & Protections
Learning Objectives
After completing, students will be able to:

 Understand what software security is

 Identify common software vulnerabilities
 Analyze software security problems
 Apply basic protection techniques
 Understand ethical and professional responsibilities

Introduction to Software Security

1. What is Software Security?

Software security means protecting programs and applications from attacks,
misuse, and damage.

It ensures that software:

 Works correctly
 Protects user data
 Resists attacks
 Week 11

Examples of software:

 Web applications
 Mobile apps
 Operating systems
 Desktop programs

If software is not secure, attackers can:

 Steal data
 Change system behavior
 Take control of computers

2. Why Software Security is Important

Software security protects:

 Personal information
 Business data
 Financial systems

Poor security may lead to:

 Identity theft
 Financial loss
 Legal issues
 Loss of reputation

3. CIA Triad in Software Security

Software security follows:

Confidentiality

Only authorized users can access data.

Integrity
 Week 11

Data cannot be changed without permission.

Availability

System remains available for users.

4. Ethical Responsibility
Programmers and IT professionals must:

 Write secure code

 Protect user privacy
 Never create harmful software

Software Vulnerabilities
1. What is a Vulnerability?
A vulnerability is a weakness in software that attackers can exploit.

2. Common Software Vulnerabilities

a) Buffer Overflow

Occurs when too much data is sent into memory.

Result: system crash or hacker access.

b) SQL Injection

Attackers insert malicious SQL commands.

Result: database compromise.

c) Cross-Site Scripting (XSS)

 Week 11

Malicious scripts are injected into web pages.

Result: session hijacking or data theft.

d) Weak Authentication

 Simple passwords
 No account lockout

Result: easy unauthorized access.

e) Outdated Software

Old versions contain known vulnerabilities.

3. Causes of Vulnerabilities
 Poor coding
 Lack of testing
 No updates
 Human mistakes

4. Problem Analysis
 Identify weaknesses
 Understand attack methods
 Suggest solutions

This is part of computing professionalism.

Software Protection Techniques

 Week 11

1. Secure Coding Practices

Developers should:

 Validate user input

 Use strong authentication
 Handle errors properly
 Avoid hard-coded passwords

2. Software Testing
Types:

 Unit testing
 Security testing
 Penetration testing

Purpose: find bugs before attackers do.

3. Patch Management
Patches fix security flaws.

Best practice:

 Update software regularly

 Enable automatic updates

4. Antivirus and Application Security Tools

These tools:

 Detect malware
 Monitor behavior
 Block suspicious activity

5. Backup and Recovery

Always maintain:
 Week 11

 Regular backups
 Recovery plans

Helps after ransomware or crashes.

6. Risk Management in Software Security

Steps:

1. Identify threats
2. Evaluate impact
3. Apply controls
4. Monitor continuously

7. Legal and Ethical Issues

 Writing malware is illegal
 Stealing data is a crime
 User privacy must be respected

A professional must follow:

 Organizational policies
 Cyber laws
 Ethical standards
 Week 12

Week 12: Firewalls, Intrusion Detection

& Security Policies

Learning Objectives
After completing, students will be able to:

 Understand the purpose of firewalls and intrusion detection systems

 Identify different types of firewalls and IDS
 Analyze network security problems
 Apply protection tools in real environments
 Understand the importance of security policies
 Discuss ethical and professional responsibilities

Firewalls
1. What is a Firewall?
A firewall is a security device or software that controls network traffic.

It acts as a security gate between:

 Internal network (trusted)

 External network / Internet (untrusted)

It allows or blocks traffic based on rules.

2. Why Firewalls are Important

Firewalls help to:

 Block hackers
 Prevent unauthorized access
 Protect internal systems
 Control incoming and outgoing traffic
 Week 12

Without a firewall, any system connected to the Internet is exposed to attacks.

3. Types of Firewalls
1. Packet Filtering Firewall

 Checks data packets

 Filters based on IP address, port number
 Simple and fast

Limitation: Cannot inspect data deeply.

2. Stateful Inspection Firewall

 Tracks active connections

 Makes smarter decisions

More secure than packet filtering.

3. Application-Level Firewall (Proxy Firewall)

 Inspects application data

 Filters web traffic, email traffic

More secure but slower.

4. Next-Generation Firewall (NGFW)

 Deep packet inspection

 Malware protection
 Intrusion prevention

Used in modern organizations.

4. Real-Life Example
In a university:

 Firewall blocks gaming sites

 Blocks harmful websites
 Protects student data
 Week 12

5. Professional Responsibility
Network administrators must:

 Configure firewall correctly

 Update rules regularly
 Monitor traffic

Misconfiguration can cause major security problems.

Intrusion Detection & Prevention Systems

1. What is Intrusion Detection System (IDS)?
An IDS monitors network traffic and detects suspicious activity.

It:

 Observes network behavior

 Sends alerts when threats are found

It does NOT automatically block attacks (only alerts).

2. Types of IDS
🔹 Network-based IDS (NIDS)

 Monitors entire network

 Detects suspicious traffic

🔹 Host-based IDS (HIDS)

 Installed on individual computers

 Monitors system activity

3. Intrusion Prevention System (IPS)

An IPS is advanced version of IDS.
 Week 12

It:

 Detects threats
 Automatically blocks them

4. Detection Methods
🔸 Signature-Based Detection

 Uses known attack patterns

 Fast and accurate for known attacks

Limitation: Cannot detect new attacks.

🔸 Anomaly-Based Detection

 Detects unusual behavior

 Can detect new attacks

Limitation: May give false alarms.

5. Problem Analysis
Students should be able to:

 Identify attack signs

 Analyze logs
 Suggest preventive measures

This improves problem-solving skills.

Security Policies & Risk Management

1. What is a Security Policy?
 Week 12

A security policy is a set of rules that defines how an organization protects its
information.

It answers:

 Who can access what?

 What is allowed and not allowed?
 What to do during security incidents?

2. Types of Security Policies

🔹 Acceptable Use Policy (AUP)

Rules for using computers and internet.

Example:

 No illegal downloads
 No sharing passwords

🔹 Password Policy

Defines:

 Password length
 Complexity rules
 Change frequency

🔹 Incident Response Policy

Defines:

 Steps to handle security breaches

 Who reports incidents
 Recovery procedures

3. Importance of Security Policies

Security policies:

 Reduce risks
 Week 12

 Protect data
 Ensure compliance with laws
 Guide employee behavior

4. Risk Management in Network Security

Steps:

1. Identify assets
2. Identify threats
3. Evaluate risks
4. Apply controls
5. Monitor regularly

Example:

Risk: Weak password

Control: Strong password policy

5. Legal and Ethical Issues

Students must understand:

 Monitoring users must follow law

 Privacy must be respected
 Security tools should not violate rights

Professional ethics require:

✅ Responsible use of tools

✅ Respect for privacy
✅ Compliance with cyber laws

Final Summary
 Firewalls protect networks
 IDS/IPS detect and prevent attacks
 Security policies guide safe behavior
 Risk management reduces threats
 Week 12

Key Message
Technology alone cannot provide security.

Security requires:

 Tools
 Policies
 Ethical professionals
 Continuous learning

A good computing professional protects systems and society.

 Week 13

Week 13 — Policy Formation and

Enforcement
Learning Objectives
After completing Week 13, students will be able to:

 Understand what a security policy is

 Explain how security policies are created
 Understand how policies are enforced
 Analyze risks related to weak policy implementation
 Understand legal and ethical responsibilities

Introduction to Security Policy

1. What is a Security Policy?

A security policy is a written set of rules that explains how an organization
protects its information and systems.

It defines:

 What is allowed
 What is not allowed
 Who is responsible
 What to do in case of security incidents
 Week 13

2. Why Security Policies are Important

Security policies help to:

 Protect sensitive information

 Reduce risks
 Guide employee behavior
 Ensure legal compliance
 Maintain professionalism

Without policies:

 Employees may misuse systems

 Data may be leaked
 Security tools may be used incorrectly

3. Types of Security Policies

1. Acceptable Use Policy (AUP)

Defines how employees/students can use IT resources.

Examples:

 No illegal downloads
 No sharing passwords
 No accessing harmful websites

2. Password Policy

Defines:

 Minimum password length

 Use of numbers and symbols
 Password change frequency

3. Data Protection Policy

Defines:

 How data is stored

 Week 13

 Who can access it

 How long data is kept

🔹 4. Incident Response Policy

Explains:

 How to report incidents

 Who investigates
 Recovery procedures

4. Link with CIA Triad

Security policies protect:

 Confidentiality
 Integrity
 Availability

Policy Formation Process

1. Steps in Policy Formation
Step 1: Identify Assets

Examples:

 Databases
 Servers
 Network devices
 Student records

Step 2: Identify Risks and Threats

Examples:

 Hacking
 Insider misuse
 Week 13

 Malware
 Human error

Step 3: Risk Assessment

Evaluate:

 How likely is the threat?

 What will be the impact?

Step 4: Draft the Policy

Policy must be:

 Clear
 Simple
 Practical
 Realistic

Step 5: Management Approval

Top management must approve policies.

Security is not only IT responsibility — it is organizational responsibility.

Step 6: Communicate the Policy

Employees must:

 Read it
 Understand it
 Sign agreement

2. Good Policy Characteristics

A good policy should be:

 Clear and simple

 Week 13

 Enforceable
 Regularly updated
 Legally compliant

3. Role of IT Professionals
IT professionals must:

 Help design policies

 Provide technical support
 Suggest improvements

This shows computing professionalism.

Policy Enforcement and Monitoring

1. What is Policy Enforcement?

Policy enforcement means ensuring that rules are followed.

Having a policy is not enough — it must be implemented.

2. Methods of Enforcement
Technical Controls

 Firewalls
 IDS/IPS
 Access control systems
 Password systems

Administrative Controls

 Employee training
 Week 13

 Awareness programs
 Warning letters

Physical Controls

 Locked server rooms

 CCTV cameras
 Access cards

3. Monitoring and Auditing

Organizations must:

 Monitor system activity

 Check logs
 Conduct audits

This helps detect violations early.

4. Consequences of Policy Violation

Violations may result in:

 Warning
 Suspension
 Termination
 Legal action

5. Legal and Ethical Issues

Policies must:

 Respect user privacy

 Week 13

 Follow cyber laws

 Avoid discrimination

Professionals must:

 Use monitoring tools responsibly

 Protect employee rights
 Maintain transparency

6. Continuous Improvement
Security policies must be:

 Reviewed regularly
 Updated with new threats
 Improved after incidents

Security is a continuous process.

Real-Life Example
University Example:

Policy:

 Students cannot share Wi-Fi passwords

 No pirated software
 Report cyber incidents immediately

Enforcement:

 Network monitoring
 Account suspension
 Awareness sessions
 Week 14

Week 14 — Risk Assessment &

Cybercrime
Learning Objectives
After completing Week 14, students will be able to:

 Understand what risk assessment is

 Identify different types of cyber threats
 Analyze risks and their impact
 Apply basic risk management techniques
 Understand cybercrime and related legal/ethical issues

Introduction to Risk Assessment

1. What is Risk?
Risk is the possibility of loss or damage when a threat exploits a vulnerability.

Risk = Threat × Vulnerability × Impact

Example:

 Weak password (vulnerability)

 Hacker attack (threat)
 Data stolen (impact)

2. What is Risk Assessment?

Risk assessment is the process of:

 Identifying assets
 Identifying threats
 Evaluating possible damage
 Deciding how to reduce risk

It helps organizations protect:

 Week 14

 Data
 Systems
 Reputation
 Financial resources

3. Key Terms
Asset

Anything valuable:

 Database
 Server
 Student records

Threat

Anything that can cause harm:

 Hacker
 Malware
 Insider misuse

Vulnerability

Weakness in system:

 Weak password
 Outdated software
 Poor firewall configuration

4. Types of Risk
Physical Risk

 Fire
 Theft
 Power failure

Technical Risk
 Week 14

 Malware
 Hacking
 System crash

Human Risk

 Employee mistake
 Social engineering
 Insider attack

5. Importance of Risk Assessment

Risk assessment helps to:

 Reduce financial loss

 Improve security planning
 Protect confidentiality, integrity, availability
 Make better security decisions

Risk Management Process

1. Steps in Risk Management
Step 1: Identify Assets

Example:

 University database
 Network servers

Step 2: Identify Threats

Examples:

 Phishing attacks
 Ransomware
 Data breach

Step 3: Analyze Risk

 Week 14

Ask:

 How likely is this attack?

 What will be the impact?

Risk level can be:

 Low
 Medium
 High

Step 4: Apply Controls

Types of controls:

Preventive Controls

 Firewall
 Strong passwords
 Encryption

Detective Controls

 IDS
 Log monitoring

Corrective Controls

 Backup recovery
 Patch updates

Step 5: Monitor and Review

Security is continuous.

Organizations must:

 Review risks regularly

 Update controls
 Improve policies
 Week 14

2. Risk Treatment Options

Organizations can:

1. Avoid the risk

2. Reduce the risk
3. Transfer the risk (insurance)
4. Accept the risk

3. Professional Responsibility
IT professionals must:

 Report risks honestly

 Suggest improvements
 Protect organizational data

Cybercrime
1. What is Cybercrime?
Cybercrime is illegal activity done using computers or networks.

It includes:

 Hacking
 Identity theft
 Online fraud
 Data theft
 Cyberbullying

2. Common Types of Cybercrime

🔹 Phishing

Fake emails to steal passwords.

Ransomware
 Week 14

Malware that locks files and demands money.

Identity Theft

Stealing personal information.

Online Fraud

Fake websites or fake offers.

Social Engineering

Tricking people to reveal information.

3. Impact of Cybercrime
Cybercrime can cause:

 Financial loss
 Loss of privacy
 Reputation damage
 Legal problems

4. Cyber Laws and Ethics

Cybercrime is punishable by law.

Professionals must:

 Respect privacy
 Follow national cyber laws
 Avoid misuse of tools
 Report cyber incidents

Ethical behavior is as important as technical skills.

5. Preventing Cybercrime
 Week 14

Prevention methods:

 Strong passwords
 Multi-factor authentication
 Regular updates
 Security awareness training
 Backup systems

Real-Life Example
University Risk Example:

Asset: Student database

Threat: SQL Injection
Vulnerability: No input validation
Impact: Data leak

Control:

 Secure coding
 Firewall
 IDS monitoring
 Week 15

Week 15 — Privacy & Anonymity

Learning Objectives
After completing this week, students will be able to:

 Understand the concept of privacy in information systems

 Explain the meaning of anonymity
 Identify privacy threats in digital systems
 Understand tools and techniques used to protect privacy
 Discuss legal and ethical issues related to privacy

Introduction to Privacy

1. What is Privacy?
Privacy means a person’s right to control their personal information.

It ensures that personal data is:

 Collected fairly
 Used only for specific purposes
 Protected from unauthorized access

Examples of personal information:

 Name
 Address
 Phone number
 Email
 Bank details
 Medical records
 Week 15

2. Importance of Privacy
Privacy is important because it protects:

 Personal identity
 Financial information
 Medical records
 Online behavior

Without privacy protection, attackers may misuse personal information.

3. Types of Privacy
🔹 Information Privacy

Protection of personal data stored in databases.

Example:
Student records in a university database.

🔹 Communication Privacy

Protection of messages and communication.

Example:
Email encryption.

🔹 Internet Privacy

Protection of user activities online.

Example:
Browsing history and online searches.
 Week 15

🔹 Location Privacy

Protection of user location data.

Example:
GPS tracking in mobile devices.

4. Privacy vs Security
Privacy Security

Protects personal data Protects systems and networks

Focus on individual rights Focus on system protection

Both are important in information security.

Privacy Threats

1. Common Privacy Threats

🔹 Data Breaches

Unauthorized access to personal data stored in databases.

Example:
A company database being hacked.

🔹 Identity Theft
 Week 15

Attackers steal personal information and use it for fraud.

Example:
Using someone’s credit card information.

🔹 Online Tracking

Websites track user behavior using cookies and trackers.

Example:
Tracking browsing history for advertisements.

🔹 Social Media Data Misuse

Personal information shared on social media can be misused.

Example:
Fake profiles or scams.

2. Privacy Risks in Digital Systems

Risks occur when:

 Data is stored without encryption

 Weak access control exists
 Users share too much information online
 Organizations collect unnecessary data

3. Protecting Privacy
Methods include:

 Data encryption
 Access control systems
 Strong passwords
 Week 15

 Privacy policies
 User awareness

4. Privacy by Design
Systems should be designed with privacy protection from the beginning.

Developers must:

 Minimize data collection

 Protect stored data
 Ensure user consent

Anonymity

1. What is Anonymity?
Anonymity means hiding a user's real identity when using the internet.

It allows users to communicate or browse online without revealing who they are.

Example:
Using anonymous browsing tools.

2. Why Anonymity is Important

Anonymity protects:

 Freedom of expression
 Journalists and activists
 Whistleblowers
 Personal privacy
 Week 15

3. Tools for Online Anonymity

🔹 VPN (Virtual Private Network)

A VPN hides a user's IP address and encrypts internet traffic.

Benefits:

 Secure communication
 Protection from tracking

🔹 Anonymous Browsing

Some browsers provide privacy protection features.

Example:
Private browsing mode.

🔹 Encryption

Encryption hides data so that only authorized users can read it.

Example:
Secure messaging applications.

4. Risks of Anonymity
Although anonymity protects privacy, it can also be misused for:

 Cybercrime
 Illegal activities
 Dark web transactions

Therefore, there must be a balance between privacy and law enforcement.

5. Legal and Ethical Issues

 Week 15

Organizations must:

 Protect user privacy

 Follow data protection laws
 Inform users about data collection

Professionals must behave ethically and respect user privacy.

Real-Life Example
Example Scenario:

A mobile application collects user location data without informing users.

Problems:

 Violation of privacy rights

 Possible misuse of personal data

Solution:

 Clear privacy policy

 User consent before collecting data
 Secure data storag
 Week 16

Week 16 — Cybercrime Law & Ethics

Learning Objectives
After completing this week, students will be able to:

 Understand what cybercrime laws are

 Identify different types of cybercrimes
 Understand legal consequences of cyber offenses
 Explain ethical behavior in information security
 Apply professional ethics in real-world situations

Introduction to Cybercrime Law

1. What is Cybercrime Law?

Cybercrime law includes rules and regulations that deal with crimes committed
using:

 Computers
 Networks
 Internet

It defines:

 What actions are illegal

 Punishments for cybercrimes
 Rights of users

2. Why Cyber Laws are Important

Cyber laws help to:

 Protect users from cyber attacks

 Prevent misuse of technology
 Week 16

 Maintain digital trust

 Support law enforcement

Without laws, cybercrime would increase.

3. Common Types of Cybercrime

🔹 Hacking

Unauthorized access to systems.

🔹 Identity Theft

Stealing personal information.

🔹 Online Fraud

Fake websites, scams, and financial fraud.

🔹 Cyberbullying

Harassing people online.

🔹 Data Theft

Stealing confidential data.

4. Cybercrime Laws in Pakistan

In Pakistan, cybercrime is handled under:

🔹 Prevention of Electronic Crimes Act (PECA) 2016

This law covers:

 Unauthorized access
 Data damage
 Cyber terrorism
 Online harassment
 Week 16

5. Role of Authorities
In Pakistan, cybercrime cases are handled by:

🔹 Federal Investigation Agency (FIA) Cyber Crime Wing

They:

 Investigate cybercrimes
 Arrest criminals
 Provide support to victims

Legal Aspects of Cybercrime

1. Cyber Offenses and Punishments
Examples:

 Hacking → fine + imprisonment

 Data theft → legal action
 Online fraud → financial penalties

Punishments depend on:

 Type of crime
 Severity
 Damage caused

2. Digital Evidence
Digital evidence includes:

 Emails
 Chat messages
 Log files
 IP addresses

It must be:

 Authentic
 Week 16

 Untampered
 Legally collected

3. Challenges in Cyber Law

🔹 Jurisdiction Issues

Cybercrime can happen across countries.

🔹 Fast-changing Technology

Laws may become outdated.

🔹 Difficulty in Tracking Criminals

Attackers hide identity using anonymity tools.

4. User Rights
Users have rights such as:

 Right to privacy
 Right to data protection
 Right to report cybercrime

5. Responsibilities of Users
Users must:

 Follow laws
 Avoid illegal activities
 Protect their accounts

Ethics in Information Security

1. What is Ethics?
Ethics means doing what is right and fair.
 Week 16

In IT, ethics guides how professionals should behave.

2. Importance of Ethics in IT
Ethics helps to:

 Build trust
 Protect users
 Avoid misuse of technology
 Maintain professionalism

3. Ethical Principles
🔹 Honesty

Do not misuse data or systems.

🔹 Integrity

Do not modify data without permission.

🔹 Confidentiality

Protect sensitive information.

🔹 Responsibility

Take responsibility for your actions.

4. Examples of Unethical Behavior

 Hacking for fun
 Sharing passwords
 Pirating software
 Spreading malware

5. Professional Code of Conduct

 Week 16

IT professionals should:

 Follow organizational policies

 Respect user privacy
 Report security issues
 Avoid conflicts of interest

6. Ethical Dilemmas
Sometimes professionals face difficult choices.

Example:

A company asks you to monitor employee emails without informing them.

Questions:

 Is it legal?
 Is it ethical?
 Does it violate privacy?

Students must learn to balance security and ethics.

7. Relationship Between Law and Ethics

Law Ethics
Enforced by government Based on moral values
Breaking law = punishment Breaking ethics = loss of trust

Both are important in information security.

Real-Life Example
Scenario:

A student hacks a university system to change grades.

Problems:
 Week 16

 Illegal (cybercrime)
 Unethical (dishonest behavior)

Consequences:

 Legal punishment
 Academic penalty