Information Security, Ethics, Legal and Social Issues
Domain 9 - Information security, ethics, legal and social issues
Tests CIA security, threats and controls, ethical conduct and Sri Lankan legal frameworks.
Core rules
- CIA: confidentiality (authorised access), integrity (accuracy/completeness), availability (timely access).
- Threats include malware, phishing, social engineering, DoS, SQL injection and insider misuse; controls include authentication, authorisation, encryption, patching, backups, firewalls and awareness.
- Risk = likelihood × impact; controls reduce risk, not necessarily to zero.
- Ethics includes honesty, privacy, intellectual property and fair access. Law and ethics overlap but are not identical.
- Sri Lanka: Computer Crimes Act No. 24 of 2007; Intellectual Property Act No. 36 of 2003; Electronic Transactions Act No. 19 of 2006; Personal Data Protection Act No. 9 of 2022.
Worked example
A student receives an email: 'Your bank account is locked; log in here' with a lookalike URL. Identify the threat and response. This is phishing/social engineering targeting confidentiality and possibly integrity. Reasoning: urgency pressures action; the URL does not match the bank's domain. Do not click; verify through the bank's official app or phone number; report to the bank and IT staff. Multi-factor authentication reduces credential theft. A backup alone would not stop account takeover.
Traps
Do not label encryption as backup. Confidentiality ≠ integrity. A firewall does not stop internal phishing. Ethical breaches may be legal or not; cite a specific Act only when confident.