Opening Thought
Before asking what must come first, I needed to understand what ethics and the CIA triad represent.
I chose to explore this question to better understand the fundamentals of information security and apply security concepts from a solid foundation—understanding the why and what before focusing on tools and controls.
What I am Studying
I am studying cybersecurity through a home lab where I can test security concepts rather than only understand them theoretically.
For TSC-001, I am exploring whether confidentiality, integrity and availability can be successfully achieved without deliberate ethical consideration, and what role human value should play when security controls are selected and implemented.
My Current Understanding
WHY — Human Value Matters
Ethics provide principles for reasoning about right and wrong and influence how we behave toward one another.
Security does not operate separately from people. The organisations we protect, the information we secure, the laws and policies we follow, and the systems we build all exist within a society made up of people.
For that reason, security decisions should deliberately consider human value—including life, safety, dignity, respect and privacy—and seek to avoid unnecessary harm.
WHAT — The CIA Triad
Confidentiality, Integrity and Availability provide foundational objectives for protecting information and information systems.
These objectives help us understand what requires protection and guide the selection of appropriate security controls.
However, successfully achieving CIA objectives does not automatically demonstrate ethical behaviour. A system can technically protect confidentiality, integrity and availability while the purpose, design or implementation of its controls fails to adequately consider the people affected by them.
HOW — Ethics and CIA Work Together
My initial question asked whether ethics must precede the CIA triad. My current understanding is that the relationship is not simply a sequence where ethics comes first and CIA follows.
Ethical consideration and security objectives should work together throughout the security lifecycle.
When selecting, implementing, reviewing, improving or retiring controls, we should consider both the security objective and the impact of our decisions on people.
A stronger control is not automatically a better control. Without deliberate consideration of purpose and human impact, we may overprotect information, introduce unnecessary controls, affect legitimate operations or consume resources where they are not required.
The goal, therefore, is not only to achieve confidentiality, integrity and availability, but to do so deliberately while considering the human value affected by our security decisions.
Research and Reasoning
I am researching Cybersecurity Ethics.
What I learned
TSC-001 is an ongoing lesson about Ethics, organisations and Cybersecurity, which I am testing and documenting.