Scenario ref. no.:

0001

Code reference:

Credibility (7.1)

CyBOK references:

A1, A2, A3

Scenario:

It emerges that an employee has breached confidentiality, by discussing the outcomes of a client project, assignment or audit with a third party. Such action could compromise the security of the business.

What action should we take? How can we stop them?

Process:

You should:

• use company disciplinary/misconduct/gross misconduct policies
• consider reporting the incident to any Body to which they are accredited.

If the individual is not accredited, consider reporting matter to the Council if their organisation is affiliated in some way.

Experience required on Ethics Committee:

Legal

HR

Board-level business

Cyber security knowledge (for implications to corporate security)

Last updated:

March 2021

Scenario ref. no.:

0002

Code reference:

Credibility (7.1)

CyBOK references:

A1, A3, B3, B4

Scenario:

A client has asked us to conduct an attack on the company that the client thinks mounted an attack on them.

Should we do this?

Process:

If your organisation is accredited to a professional or trade body: seek its advice. That body may then handle the incident via its own existing Codes of Conduct, or may decide to take it to the Ethics Committee for further opinion.

If your organisation is not accredited to a professional body: report this issue to the Council’s Ethics Committee.

Note that, in the UK, this action is illegal under the Computer Misuse Act and should be reported to the authorities.

Experience required on Ethics Committee:

Cyber security

Legal

Last updated:

March 2021

Scenario ref. no.:

0003

Code reference:

Credibility (7.1)

CyBOK references:

A1, A2, C1, C2, C4?, D1, E1

Scenario:

It is discovered, during an assignment, that a client subject to national or international legislation/security frameworks (eg. PCI-DSS, GDPR) has had a serious security breach. However, the client refuses to follow the mandatory reporting procedures.

What should we do?

Process:

Irrespective of whether the issue is legislative or security framework-related, you should strongly encourage the client to report.

If your advice is ignored and the issue is related to legislation: there may be a legal obligation for a security professional to report the breach to the appropriate body.

If your advice is ignored and the issue is security framework-related: the obligation to report may not be as clear cut. You may require the guidance of NCSC, the Council or other appropriate professional and/or trade body.

You should also:

• ensure that any confidentiality agreements in place specifically include an exemption for these types of circumstances
• consider carefully the risks of disclosure of client confidential information to avoid breakdown of trust with the organisation.

Seek advice from the Regulator if legislative/security frameworks are applicable.

Experience required on Ethics Committee:

Cyber security

Legal

Last updated:

March 2021

Scenario ref. no.:

0004

Code reference:

Integrity (7.2)

CyBOK references:

C1, C2, C3, C4

Scenario:

It emerges that a probe has been left in place on our network by a supplier at the end of a penetration testing assignment.

What should we do?

Process:

Establish whether action was intentional or accidental. This should determine whether the action was an ethical breach or not.

If the supplier responsible for leaving the probe is accredited to a professional body: raise a formal complaint to that body. That body may then handle the incident via its existing Codes of Conduct, or it may choose to take it to the Ethics Committee for a consolidated view.

If the supplier responsible for leaving the probe is not accredited to a professional body:

• raise a complaint using the supplier’s complaints procedure; and
• report the issue to the Council’s Ethics Committee.

Your supplier should provide formal assurances that:

• all probes have been removed; and
• any data gathered via the probe has been suitably destroyed.

If the supplier is an accredited company, you should expect the process for this to be validated at the point of next audit.

You should also ask for evidence that the policy has been distributed to all relevant staff members.

If the incident is deemed to be unethical practice, your supplier should:

• bear the cost of removal; and
• cover any consequential costs associated with rectification.

Experience required on Ethics Committee:

Technical cyber security organisation(s), e.g. CREST, NCSC – particularly if your supplier is an accredited company since, in which case action may be taken [by their accrediting body] via their own codes and processes.

You may require Legal advice regarding appropriate financial recompense.

Last updated:

March 2021

Scenario ref. no.:

0005

Code reference:

Integrity (7.2)

CyBOK references:

C1, C2, C3, C4

Scenario:

It emerges that a "honeypot", impersonating a real company or individual, is being used during a red-team penetration testing assignment without the knowledge or consent of the organisation or individual.

What should we do?

Process:

Establish whether action was intentional or accidental. This should determine whether the action was an ethical breach or not.

If the supplier responsible for leaving the probe is accredited to a professional body: raise a formal complaint to that body. That body may then handle the incident via its existing Codes of Conduct, or it may choose to take it to the Ethics Committee for a consolidated view.

If the supplier responsible for leaving the probe is not accredited to a professional body:

• raise a complaint using the supplier’s complaints procedure; and
• report the issue to the Council’s Ethics Committee.

If the incident is deemed to be unethical practice, your supplier should:

• provide formal assurances that policies have been updated to reflect a requirement to notify any organisation that has been subjected to this practice; and
• notify relevant staff accordingly

Experience required on Ethics Committee:

Technical cyber security organisation(s), e.g. CREST, NCSC – particularly if your supplier is an accredited company since, in which case action may be taken [by the accrediting body] via their own codes and processes.

Legal

Last updated:

March 2021

Scenario ref. no.:

0006

Code reference:

Integrity (7.2)

CyBOK references:

A1, A2, A3

Scenario:

During production of a report for an organisation that has had a penetration test conducted, it emerges that the supplier was unduly influenced by that organisation to issue a positive report on the outcome; or, conversely, to withhold information from the report.

What should we do?

Process:

You should consider carefully the risks of disclosure of client confidential information to avoid breakdown of trust with the organisation.

If the supplier responsible for leaving the probe is accredited to a professional body: raise the issue to that body. That body may then handle the incident via its existing Codes of Conduct, or it may choose to take it to the Ethics Committee for a consolidated view.

If the report relates to a regulated scheme, report the issue to the Regulator.

Experience required on Ethics Committee:

Technical cyber security organisation(s), e.g. CREST, CIISec, BCS – particularly if your supplier is an accredited company since, in which case action may be taken [by the accrediting body] via their own codes and processes.

Board-level business.

Last updated:

March 2021

Scenario ref. no.:

0007

Code reference:

Integrity (7.2)

CyBOK references:

A1

Scenario:

We’ve identified misuse or exploitation of information, including for personal gain, in our organisation.

Where should we report this?

Note: there is a similar example in the scenarios for Individuals*.

Process:

If your organisation is accredited to a professional or trade body, you should consider seeking its advice, which will be independent.

Alternatively, consult the Council.

Experience required on Ethics Committee:

Legal

Board-level business

Last updated:

March 2021

Scenario ref. no.:

0008

Code reference:

Integrity (7.2)

CyBOK references:

A2, A3, A4

Scenario:

We are being asked to pay a Bug Bounty reward, but we are aware that the individual is a minor.

What do we do? Should we report it and, if so, to whom?

Process:

CREST has published this useful reference information on Bug Bounties.

Experience required on Ethics Committee:

Cyber security

Legal

Last updated:

March 2021

Scenario ref. no.:

0009

Code reference:

Professionalism (7.3)

CyBOK references:

B3, C2, C4, E1, E2

Scenario:

A "backdoor" to a product has been identified that would allow unauthorised access to a network (or similar).

Where and how do we report this?

Process:

You should report serious vulnerabilities quickly and securely to the vendor or system owner (which may be your client). You will need to balance the public right to be informed and allowing the vendor or owner time to respond effectively.

When reporting to the vendor/system owner, you should also:

• ensure sufficient information is provided to allow them to verify and evaluate the risk
• apply your best efforts to preventing further exploitation that could adversely affect product or system availability, data integrity or confidentiality
• ensure open and positive communication channels
• consider carefully the risks of disclosure of client confidential information to avoid breakdown of trust with the organisation.

If appropriate (depending on product type): advise Government or the appropriate Regulator.

Experience required on Ethics Committee:

Cyber security

IoT (if appropriate)

Last updated:

March 2021

Scenario ref. no.:

0010

Code reference:

Professionalism (7.3)

CyBOK references:

B3, C2, C4, E1, E2

Scenario:

We have established that the supplier of a component part of our security architecture is making claims about the product that are untrue.

Should we report this?

Process:

If the supplier is a member of the UK Cyber Security Council, you should report the issue to the Council.

If the supplier is not a member of the Council, but is a member of another professional or trade body, you should report the issue to that body.

If the supplier is not a member of any body, you should open a dialogue with the supplier in the first instance.

Experience required on Ethics Committee:

Last updated:

March 2021

Scenario ref. no.:

0011

Code reference:

Professionalism (7.3)

CyBOK references:

A1, E2

Scenario:

A team of security researchers has discovered vulnerabilities in our product and is going to announce these at the conference Defcon. Although we’re aware that the team of researcher researchers would release its findings, we’ve continued to sell the product anyway.

What should we do?

Process:

You should:

• complete a risk assessment to understand fully
• the security issues that have been identified; and
• how they will be fixed

As part of this process, you should consider how to publicly disclose your awareness of this issue and how it will be dealt with.

If not already in place, you should:

• consider implementing a vulnerability disclosure policy as per the DCMS Secure by Design Code of Practice (ETSSI EN 303 645); and
• develop a policy around how disclosed vulnerabilities will be acted on in a timely manner with your organisation.

For further guidance on vulnerability disclosure, refer to the ISO/IEC 29147 standard.

Experience required on Ethics Committee:

Cyber security

Legal

Last updated:

March 2021

Scenario ref. no.:

0012

Code reference:

Professionalism (7.3)

CyBOK references:

A2, A3, A4

Scenario:

We have been contacted by a researcher who says that they have identified vulnerabilities with our product and are willing tell us subject to a fee. We do not have a bug bounty program.

Should we pay? What if we refuse and they leak to hacker community?

Process:

Most hunters will settle for acknowledgment, but the motivations of ethical hackers and criminal hackers are very different.

You may consider:

• setting up an email address that will accept bug reports. ISO/IEC 29147 advises tech firms to establish a communications system by which it can receive bug reports.
• establishing a Bug Bounty programme. CREST has published this useful reference information on Bug Bounties.

Experience required on Ethics Committee:

Cyber security

Legal

Last updated:

March 2021

Scenario ref. no.:

0013

Code reference:

Responsibility & Respect (7.4)

CyBOK references:

C1, C2, C3, C4

Scenario:

We’ve discovered that a supplier has caused damage to our website during a routine penetration test.

What action can we take?

Process:

Firstly, you should ascertain whether or not the supplier acted reasonably.

If the supplier responsible is accredited to a professional body: raise a formal complaint to that body. That body may then handle the incident via its existing Codes of Conduct, or it may choose to take it to the Council’s Ethics Committee for a consolidated view.

If the supplier responsible is part of a Regulator scheme – for example, it is a CHECK provider – you should raise the issue with that Regulator.

If the supplier responsible is not accredited to a professional body:

• raise a complaint using the supplier’s complaints procedure; and
• report the issue to the Council’s Ethics Committee.

If your supplier is found to be at fault and is an accredited company, you should expect the process for this to be validated at the point of next audit.

You should also ask for evidence that the policy has been distributed to all relevant staff members.

If your supplier is found to be at fault:

• it should cover any consequential costs associated with its rectification.
• advise the appropriate Regulator, if applicable – for example, this would be the NCSC for a CHECK scheme member

Experience required on Ethics Committee:

Technical cyber security organisation(s), e.g. CREST – particularly if your supplier is an accredited company since, in which case action may be taken [by the accrediting body] via their own codes and processes.

NCSC

You may require Legal advice regarding appropriate financial recompense, if a resolution is unsatisfactory or unachievable.

Last updated:

March 2021

Scenario ref. no.:

0014

Code reference:

Responsibility & Respect (7.4)

CyBOK references:

A1, B1, D1, E1, E2

Scenario:

My organisation has received a ransomware demand. Management wants to pay, but someone on the management team believes that it is inappropriate or illegal.

Should we pay to recover our information?

Process:

Ensure that your data has actually been encrypted and that you are not a victim of "scareware".

Refer to NCSC’s advice on mitigating ransomware attacks.

Take legal advice on whether funds can be lawfully remitted into the hands of a ransomware operator.

Paying your attackers does not guarantee that files will be returned or that decryption functionality has been built into the malware: on average, 25% of data is not returned. The longer a ransom payment is delayed can also affect the quantity of data that might be returned.

You should:

• develop a business continuity plan
• ensure staff are trained to be cautious about attachments and links in emails and visiting unknown websites
• consider additional cyber insurance to mitigate against financial losses.

You should also report such incidents to the Police and other law enforcement agencies, including NCSC.

Experience required on Ethics Committee:

Technical cyber security organisation(s), e.g. CREST, NCSC – particularly if your supplier is an accredited company since, in which case action may be taken [by the accrediting body] via their own codes and processes.

You may require legal advice.

Last updated:

March 2021

Scenario ref. no.:

0015

Code reference:

Responsibility & Respect (7.4)

CyBOK references:

A1, A3

Scenario:

When recruiting for a sensitive security role, is it acceptable for my company to conduct background research on a candidate’s personal life via social media?

Process:

Depending on the circumstances, you should seek advice from:

• your HR department
• an appropriately qualified lawyer

Experience required on Ethics Committee:

Legal

HR

Board-level business

Last updated:

March 2021

Scenario ref. no.:

0016

Code reference:

Responsibility & Respect (7.4)

CyBOK references:

A1, A3

Scenario:

We have been asked to punish staff for failing our simulated phishing exercises.

Should we do this?

Process:

No: NCSC advises against punishing staff, particularly around simulated phishing attacks.

Be aware that punishing staff for such action can encourage cover-ups, which may lead to more serious breaches.

Experience required on Ethics Committee:

Legal

HR

Cyber security

Last updated:

March 2021