Security and Risk Management · Topic 1 of 7
Ethics and Security Concepts
The ISC2 Code of Ethics canons and how to apply them, plus confidentiality, integrity, availability, authenticity and nonrepudiation for the CISSP exam.
- 4 min
- Includes a diagram
- Four canons in order: society, honour and law, principals, profession.
- A higher canon outranks a lower one when they conflict.
- CIA plus authenticity and nonrepudiation; DAD is the opposite.
What it is
CISSP holders agree to the ISC2 Code of Ethics, and the exam tests whether you can apply it when duties conflict. The domain also starts with the core security concepts: the properties of information that every control exists to protect.
How it works
The ISC2 Code of Ethics
The code has a preamble and four canons, applied in order of priority:
| Canon | Meaning in practice |
|---|---|
| 1. Protect society, the common good, necessary public trust and confidence, and the infrastructure | Public safety and trust come before any employer or client |
| 2. Act honorably, honestly, justly, responsibly, and legally | Do not lie, hide findings or break the law |
| 3. Provide diligent and competent service to principals | Serve your employer and clients well and within your competence |
| 4. Advance and protect the profession | Support the profession and its reputation |
When two canons conflict, the higher one wins. Hiding a known risk to the public to please an employer violates canon 1. Taking work you are not competent to do violates canon 3.
In ethics questions, look for the option that is honest, legal and transparent. Concealing a finding, misleading an auditor or helping someone bypass a control is never the answer.
Organizational code of ethics
Organizations also publish codes of conduct. Security professionals help write, promote and enforce them. Codes work only when management follows them visibly and violations have consequences.
The CIA triad and beyond
| Property | Protects against | Typical controls |
|---|---|---|
| Confidentiality | Unauthorized disclosure | Encryption, access control, classification |
| Integrity | Unauthorized or accidental change | Hashing, digital signatures, change control, input validation |
| Availability | Disruption of access | Redundancy, backups, capacity planning, DDoS protection |
| Authenticity | Fake origin or identity | Strong authentication, digital signatures, certificates |
| Nonrepudiation | Denying an action later | Digital signatures with protected private keys, trustworthy audit logs |
The opposite of CIA is often called DAD: disclosure, alteration and destruction (or denial).
Related concepts
- Identification, authentication, authorization and accountability (sometimes with auditing) form the access control chain. Accountability requires that actions are traceable to one person.
- Privacy concerns personal information and the rights of the individual; it depends on confidentiality but adds legal and ethical duties.
- Balance: stronger confidentiality can reduce availability; the right balance depends on the business and the data.
A worked scenario
A consultant finds that a client's medical device firmware has a flaw that could endanger patients. The client asks the consultant to say nothing until the next product release in a year. Canon 1 (protect society) outranks canon 3 (serve the principal). The consultant should press for responsible disclosure through the proper channels, not keep silent.
How the exam asks about this
- "Which canon is violated?" Match the behaviour to the canon, remembering the order.
- "What should the security professional do?" Choose the honest, lawful option that protects the public, then the employer.
- "Which control supports nonrepudiation?" A digital signature with a key only the signer holds.
What to remember for the exam
- Four canons in order: society, honour and law, principals, profession.
- A higher canon outranks a lower one when they conflict.
- CIA plus authenticity and nonrepudiation; DAD is the opposite.
- Integrity is protected by hashes, signatures and change control; availability by redundancy and backups.
- Nonrepudiation needs a signature from a key only one party holds.
A symmetric message authentication code proves integrity and origin between two parties who share the key, but not nonrepudiation, because either party could have created it.
Common mistakes
Putting the employer first. Canon 1 comes before principals.
Treating encryption as an integrity control. Encryption protects confidentiality; hashes and signatures prove integrity.
Confusing authentication with authorization. One proves who you are; the other decides what you may do.
Check yourself
Which canon takes priority when an employer asks you to hide a public safety risk?
Canon 1: protect society, the common good, public trust and the infrastructure.
Which control provides nonrepudiation?
A digital signature created with a private key that only the signer holds.
What does the DAD triad stand for?
Disclosure, alteration and destruction (or denial), the opposites of confidentiality, integrity and availability.
Topic 1 of 7 in Security and Risk Management
Test yourself on Security and Risk Management
The full ISC2 CISSP question bank has 1,113 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.