[Music]
thank you
[Music]
all right
foreign
model and the framework actually which
is something like a a maturity model but
the reason I really got into this was
because I was I kept seeing my little
statistic is the number of reached
records per population in the United
States and usually the number of reached
records is about 360 million which is
approximately equal to the population of
the United States or higher than that or
even double that so um so I kind of got
this picture that security is not well
funded in Industry
um you know reaches our Ransom Crime
Pays which is ransomware so if you think
about risk usually you pay for risk up
to the point of you know you pay for
controls up to the point of of your risk
uh
and
um and it affects effectively the world
is not
um if you look at the world itself it
obviously is not paying enough for for
security uh one of the other things you
can think about is really that we've
eradicated all sorts of diseases we've
spent a lot of time you know eradicating
and paying for diseases to go away but
it that isn't true in security so the
question is is um our company is you
know only looking for profit is there a
lack of interest is it an engineering
problem and
um uh and what's the what is ethical
risk and you know how can we help to
solve this problem from an ethical risk
perspective
so I I developed a model and it's really
based on the next slide but let me
introduce it anyway
um the first one is risk immature it's
it's those small businesses that have no
clue that they need to be concerned
about risk and then there's
self-protection which a lot of companies
are at which basically we protect our
organization and then there's the next
level up which is compliance which is we
need to adhere to laws we're going to
try to adhere to laws and then there's
stakeholder concern which is you know
being concerned with customers but also
being concerned with our employee our
employees our financiers our suppliers
our community the people we do business
with every day and then the the top is a
societal concern and this is concern for
the society and environment
now this model really
came out of her corresponds with
Colbert's Kohlberg's
levels of moral judgment and his six
stages which in the bottom two and
kohlberg is a psychologist and so he
basically said that you know at the
lowest stage we had the pre-conventional
morality respect for power and
Punishment and really the two stages
that are part of that is obedience to
Authority and we benefit each other
Mutual deals so you can kind of think of
that kid who screens in order to get the
candy he wants right you know and we'll
make a deal I'll stop screaming if you
give me the candy that I want the next
level up is conventional morality which
is social values and rules and this is
social approval good versus bad and we
all know what's what Society improves
and what they don't approve part of that
is how we dress every day
and the next is obey social legal and
religious laws
depending on what you
um
you've practiced basically and then
there's the post-conventional justice
and Welfare which is to benefit Society
often trying to change laws and ethical
principles over social norms now a
Piaget is basically in the education
world and he teaches
he basically talks about how students
children learn ethical values and the
the what they go through is the premoral
egocentrism respect for authority and
rules the second level is hetero heteron
heteronome whatever cooperation of
mutual respect and then there's the
autonomous level which is a reciprocity
and equality at the business level we
have Friedman and Freeman and I will
talk about them as I go through the
different levels so let's start off with
risk and mature and risk you know risky
mature are those small businesses that
have no clue that they should be
concerned about risk or security for
that matter and the two steps here would
be adopt and standardized risk process
which uh you guys are all probably
fairly familiar with at least have some
understanding of but the other is create
a culture of risk communication and this
is really deals with ethics so let me go
over what's involved with that the first
is involve business management so
basically business
um you know the management will never
buy into something that they don't
understand very well and so it is
important that they go through that they
help to develop this the risk scenarios
and risk scenarios or stories that
describe how an actor might Implement a
threat to an asset via an event with a
time frame
uh so
um uh so it's really important just to
uh to include them the next is creating
a culture of communication and
responsibility and this really uh hits
from both sides one side is from the
manager side and
um uh and I don't know if you've ever
been in a meeting and you've suggested
something and uh the manager basically
poo-poos your idea
um then uh you know you're not likely to
speak up again
um on on that idea or even on others and
effectively
employees must feel comfortable asking
for help reporting ethical issues and
bad news to management without being
dismissed and um and and basically
business management understands that
loyalty comes from ethical leadership
and employee contribution to decision
making
uh so from the employee side employees
also must communicate effectively with
management
and
there's really two parts to this one
part is to basically ask until their
questions are answered which
probably is going to get them in a
little bit of trouble but effectively
ask nicely you know well what happens if
this happens until there is at least
some form of answer coming back
but the second thing that needs to
happen is that um as technical people
very often
we we know that we have a technical
vocabulary and it's hard to communicate
that to management and so effectively we
can say well you know that issue
occurred because of a technical issue
um and that excuses us but but on the
other hand maybe we should be saying
because we have an older firewall and if
we had a newer one then
um uh then perhaps this problem wouldn't
have occurred so uh well not perhaps
then this this problem would not have
occurred because it would have caught
this
so it's um it's it's the the
communication has to happen on both
sides the next is to document and
communicate risk findings and I think a
lot of people in the security world uh
can get frustrated because uh you know
there's a security recommendations don't
go anywhere
um or don't go as far as they would like
it to and um and effectively
um uh if you I'm basically a c risk and
a um you know isaka see risk and and
isaka
um certified Information Systems auditor
and one of the things that they
emphasize is okay there's
um
the raci which stands for responsible
accountable consultant and informed and
basically management is responsible for
making decisions uh you aren't
um you know if you're a security
professional you aren't responsible for
that so effectively your job is to
inform them and then their job is to
make the decision and you can't feel
guilty about their decision so
um so that is
all you can really do is inform them and
then you know document your
recommendations and make sure that
they're recommend you know that their
decisions are documented next we're
going to go on to the self-protection
level and the sun protection level
really comes out of Milton Friedman
who wrote what does it mean to say that
the corporate executive has a social
responsibility in its capacity city as a
businessman if this statement is not
your rhetoric it must mean that he is to
act in some way that is not in the
interest of his employers for example
that he is to refrain from increasing
the price of a product in order to
contribute to the social objective of
preventing inflation even though a price
increase would be the best interest of
the corporation or that he used to make
expenditures on reducing pollution
beyond the amount that is in the best
interest of the corporation or that is
required by law in order to contribute
to the social objective of improving the
environment
now we know that
um a lot of organizations now are
concerned about the environment they are
spending money beyond what they need to
for um uh for
um
too due to regulation so basically you
know this is uh one popular ideology but
a number of organizations go beyond it
the self-protection level obviously you
need to convince management of
why they need to spend on security and
so it's a good idea to to look at how
it's going to protect them on average
five percent of Revenue is lost annually
due to fraud that is across decades and
decades it is also across countries
that it's you know at least that much so
effectively
um uh and there's some additional
statistics there but the key practices
here at the higher level are trained to
evaluate fraud security business risk
manage for organizational sustainability
um and there I don't mean Environmental
um it calculate quantitative risk
analysis for the organization so let's
look at some of the specifics under that
so the first is provide an anonymous
recording mechanism for ethical
violations and basically again another
statistic that shows up again and again
year after year across continents is
that the most popular way of finding
fraud is to have some way of getting
tips okay so uh so basically people
including
customers vendors and employees really
want some Anonymous way of reporting
tips either Anonymous or they can be in
person so so this is the most popular
way of detecting or you know
potentially yeah well I'm detecting
fraud
the next is develop a code of ethics
addressing organizational and
sustainability one of the things that I
think is really interesting is the C
risk manual
um see risks being
um
certification for risk and information
assistance controls they explicitly
recognize that management may choose to
ignore regulation when the cost of
compliance exceeds the law spines or or
Consequences which basically means that
um
uh even though the sea risk manual does
talk about how you should handle
um
regulation they recognize that evidently
it is perfectly okay not to adhere to it
um so unfortunately with no code of
ethics
basically each employee's home moral
behavior
is going to equal their business and
World Behavior so at that point you need
some kind of code of ethics now at the
at this level okay which is you know the
self-protection a lot of the code of
ethics attempts to
basically protect management so it'll
say something like members should
promote Management's understanding of
information processing methods and
procedures members owe trust to their
employers to Garden the employees
interest the employer's interests and to
advise the employers wisely and honestly
the the next is pricing insurance with
discounts for controls
um so basically uh you know obviously
one risk mechanism uh to handle risk one
treatment to handle risk is to use
Insurance to purchase insurance and what
does Insurance do well it protects you
but it means that you don't have to
implement any controls in other words it
doesn't make the problem any any better
at all okay so I'll just give an example
of this because I was interested in this
ethical risk concept I wrote a paper on
um on school on school shootings and uh
and basically looked at what is the
probability that a school shooting is
going to happen
and then what is the impact if it does
happen and believe it or not
um and I and I use various ethical you
know I kind of use this to say well
let's look at you know if we find it
this way or that way or some other way
how how would it turn out well it turns
out that even large universities really
large universities should spend about at
most three thousand dollars a year to
protect uh protect students and and that
includes the most ethical you know
standards for risks so basically
um with less it might be you know below
a thousand
um and uh fortunately I worked at
University of Wisconsin Parkside where
where we can lock the doors from the
inside of each of the classrooms and
they spend a heck of a lot more than
three thousand dollars to accomplish
that so I'm internally grateful that
they didn't do a good risk quantitative
risk for that
and now we're going to go into
compliance concern and compliance
concern is is obviously concerned with
with regulation and courts and that kind
of thing so um Economist Ronald Coast is
the person that I'm talking about here
and one of the things that I thought was
interesting about what he said is that
there's really two sides to every story
and this is true for regulation and for
um for like lawsuits okay and that is is
that uh one side wants to do business
and the other side doesn't want to get
hurt and one possibility is that if you
take away this then then the person who
doesn't want to get hurt doesn't get
hurt but on the other hand you really
hurt them the um the employer you know
kind of deal and the other possibility
is that you just help the employer
um and and potentially really hurt the
customers of the the people in the
society and so there needs to be a
balance between the two
which I I thought was interesting in in
him pointing that out
now I think with compliance concern in
order to raise your management to that
level if they are not uh you kind of
have to really talk dollar figures
because dollar figures speak to
management and so I put some figures
together Capital One was fined 80
million
Wendy's was to find 50 million and this
is regulatory okay
Texas paid 3.2 million Texas hospital
Target made 18.5 million and Google was
buying 50 million euros with gdpr so if
that doesn't get people's attention
um I'm not sure what would but
effectively key practices at the highest
level include a train for compliance
risk value legal endurance within
management address regulation fully
consider legal responsibility Beyond
regulation and follow software standard
units for Quality Security and safety
and we'll go into some of those
aspects so the first one is lead
ethically in other words management has
to
exemplify what they want from their
employee employees so management should
exemplify train for award and promote
good ethical behavior and correct bad
behaviors both in person in the training
room so
and um I as you may notice I actually
went a little bit into the business as
well as the security
stuff in this in this paper and then
talk about threat but the fsgo is is
regulation relating to business ethics
and they require that a high level
management position or person be
assigned overall overall responsibility
for compliance and ethics in an
organization
the next is design assign ethical risk
accountability so basically
um you know how how does this happen in
an organization and let's
um start with the executives they have
to establish a culture of safety the
project managers must ensure safety is
given due consideration and then
developers also have some responsibility
they have to identify compliance or
moral problems collect facts and
evaluate alternative Solutions implement
the solution and monitor results as
feedback now users also are involved in
this they are responsible for their
actions and may need training for proper
product operation
okay the next is addressing regulation
and
um and there's various aspects to this
um so the first thing is
um and this is basically from a secret
more than anything else uh developed by
compliance oriented business impact
analysis for privacy regulation and
privacy impact analysis for example so
you need to develop scenarios to
demonstrate how the regulation affects
the business the scenarios are the
stories quantify the cost of
non-adherent to regulation consider
civil law and third-party liabilities
such as contracts intellectual heart
property and privacy
and and to evaluate in international
regulations as well since many companies
operate in multiple countries
[Music]
at any time and and the next concern is
Rule versus the intent of the law one of
the things that Friedman will say later
on in the presentation is that when
regulation needs to be Rewritten that is
a failure of management
because obviously they didn't do it well
enough so
the next
which really kind of goes into that
lawsuit aspect is evaluated product
liability
and one of the major areas right now
that are ripe for liability issues is
artificial intelligence and artificial
intelligence right now often trains on a
biased manual systems and so effectively
what they turn out is is biased
decisions and those biased decisions are
occurring in criminal justice Health
Care employment and education and
basically this perpetuates systemic harm
causing long-term maltreatment that
basically affects people's lives and
deaths uh so
um uh effectively
um
uh what what should happen from an
engineering this perspective is to
consider how the algorithm will likely
impact special groups is it accurate and
fair uh in other words I know in one
study they they basically
looked at the rate of recidivism
for people who uh
[Music]
at the basement were by the judicial
system and whether people should be able
to be put on parole and they found out
the number one factor was your race as
to whether you got the um
uh
uh whether you've got the parole or not
so consider how the algorithm will
likely impact special groups is it fair
accurate and fair observe use in
implementation evaluating greater
fairness on special groups so after you
before you walk moment to look at the
rate after you were implement it see how
it's handled and then publicize how the
algorithm Works in order to promote
transparency
manage projects responsibly those people
who are in development know that
sometimes the most
serious concern is schedules schedules
schedules and unfortunately
this may lead to a series of lies and
bad decisions
with products being delivered late or
missing features or products are lacking
quality and or documentation so
um
so it is important to manage those
projects responsibly in a way to do that
is is realistic project management
comprehensive risk management good
communication quality software
development standards a code of conduct
and ethical training
develop and follow soft law
so in the legal
situation basically if if you can show
that you you know have adeared to the
law
and particularly its intent then
um you know when bad things happen to
you anyway you get off a lot easier if
not entirely and in many places there is
no law so one way that companies
basically make sure that they um
uh can protect themselves is to develop
salt salt Rod now some of law is is not
law that's
um that's regulated by legislators but
basically it's industry groups that get
together that say this is what equality
standard is and so there's a number of
different soft laws that have been
developed for this purpose a number of
organizations
um I'll participate in and they're
listed they're listed here
configure software for policy choice and
um and and basically
um
when you're developing software
very often you may have one customer in
mind for who you're planning to sell
this to but effectively
um you know the worldwide
[Music]
implementation of this or shall we say
being able to sell worldwide is very
attractive but a lot of Nations have a
lot of different regulations so if you
can configure the software for the
particular regulations it means that
that basically you may be able to sell
sell more
which actually adheres to the regulation
as well as what the companies are
interested in so if you talk to
different companies they may have
different standards and and if you can
config if you make those different
options configurable then at that point
uh there you know this is a good thing
for for adherential regulation
next we're going to go into stakeholder
concern and and this is by Edward
Freeman
um and he basically
said in one of his books so even if the
ideologues who insist that the only
legitimate purpose of a business is to
maximize shareholder value or maximize
profits the only way to do that is to
create great project product products
and service that customers want to buy
he also said that deception erodes trust
and trust is required for economic
transactions business management
responsibility for the effects of their
of their actions including defending
themselves to 60 Minutes of reporters
what new regulation or when new
regulation or litigation arises the
implication is Business Management
failure
uh so if we um so basically the idea of
stakeholder concern is uh is that we're
concerned with
um uh with our how our customers feel
you know uh you know that we're that
we're making our customers happy
um our employees want to be loyal to us
our vendors financiers
um uh uh all
um are interested in
um you know and working we work well
with them okay in a risk scenario I
thought was really interesting was in
the news and that is that
[Music]
um
Russian hackers offered a
russian-speaking Tesla employee one
million dollar to install a ransomware
attack and this Tesla employee turned it
down and actually worked with law
enforcement but certainly
um you know if you're a corporation can
you be be pretty well assured that all
of your employees like you enough to
turn down a one million dollar bribe
I think that's a lot to ask for but
still I think it raises the question
so some of the key practices are learn
the context of the business process and
our product development and manage with
the view toward all stakeholders discuss
the qualitative impact of risk affecting
all stakeholders stakeholders evaluate
the impact of risk
quantitatively inform communicate
ethical risk to stakeholders and
evaluate risk and supplement
implementation for all stakeholders so
let's go through some of those learn the
context of the business process in our
product development well very often
uh if you if you talk to Engineers about
what is a security concern
um uh you know there's only a few things
they will come up with which is
basically malware firewalls
um you know that kind of thing it's very
limited they stay only within the
security realm they don't look at the
business realm at all so if you're
dealing with health care they're not
necessarily
legal engineering for example that could
happen within that business realm and um
and so I I it's important for engineers
to not just look you know to not just
think okay it's it's only about
firewalls and and
intrusion detection and logs and that
kind of thing
so develop developers must understand
the context legal and ethical
requirements of the application they
need to understand the complex social
environment that includes their their
clients their users the customers and
the business and as well as
understanding the things related to
um to the software specialty in
including security and safety
implications which of course many
developers don't even get that far
so the next thing is as the world
changes a different different ethical
decisions may arise your um yearly so
that becomes important as well
the next issue is personalized risk and
one of the things I was thinking about
last night was
was that most value of Life estimates
often come out of what a person will
earn through the rest of their through
the rest of their life and so I said
well okay let's let's just take
um you know fifty thousand dollars which
I think most people in this room if
they're not making more than that then
they will be very soon but effectively
you know the average American probably
might be a little closer to that range
fifty thousand dollars 40 years is
basically two million dollars so that
puts the the value of Life at about two
million dollars for the average American
is there anyone in this room who would
consider their life as being that value
interested two million dollars okay
um not at all I'm sure you know everyone
is well about that and in fact actually
when Studies have been done
where you ask people to work on
skyscapers for example how much are you
willing to you know how much do you need
to to earn in order to build on some of
this on the some of the skyscrapers in
the in the building of that
um
they've they can come to other estimates
of what how people value their life and
so the U.S and EPA has estimated life at
7.4 million and a study in 1984 dollars
was two to eight million
with one I think at 12 million okay so
so basically
one issue needs to be that we need to
Value life realistically in these risk
um
uh risk it you know
risk analysis quite a data risk analysis
um the solution is really to include
employees and customers in Risk
decisions and um one issue I'll be
talking more about is the public
tendency risk as a binary moral decision
not as a probability so that should be
something to be aware of
evaluate trade-offs of concern so any
any kind of decision including
development or for that matter business
business decision you have to make
trade-offs between different values so
on the right hand side we can see that
particularly in development you might
want to you have to get owner values and
user values as well as then extract the
process requirements and the product
requirements
for development on the left hand side we
see a number of arrows and basically as
we're working with the decision we can
draw lines somewhere along uh this these
arrows to say that yeah this should be
you know this is this reliable but it
needs to be more reliable that's this
secure but it needs to be more secure
for example and then you can start
trading off some of those values
consider risk beyond the expected broad
framing consider considers worst case
scenarios and should be permitted to be
considered and the vision zero principle
considers how to control for no risk of
death or severe harm
uh evaluate the outrage Factor
um the Sandman
worked with risk where he says you know
normal risk is likelihood times impact
but what if we act add in an outrage
Factor okay so now risk is equal to the
annual loss expectancy is equal to
likelihood times implant impact plus
outrage and outrage is the employee at
is basically society's
consideration of this and basically
things that are not in control that
affect human life and are morally
problematic
okay would tend to increase that value
of the outrage in in the Public's
understanding and this is why after
Three Mile Island
um
uh nuclear facilities uh were now built
so
um the public tends to focus on the
moral aspects of risk including what
risks are deemed acceptable and why what
will happen if the risk actually occurs
and providing facts and statistics does
not solve the ethical dilemmas nor does
it lower the controversy and public
controversy is in fact an indicator of
an unresolved World moral issue and I
think if you look at the newspapers
today you'll see a number of moral
issues that are problematic where we're
not agreeing on things
so it is
um I I think you know actually in the
engineering World
um if if you look at you know
I basically look at IEEE you know a lot
of those papers and uh the ones related
to electrical engineering
um and and Engineering in general uh
basically
um they're concerned about safety and
they have ways of really building that
in and of course that ends up going into
regulation and standards and so on and
so forth
but in in software a lot of times you
know insecurity doesn't make it and
um and so effectively
um uh
you know we we don't sometimes Security
will go in last and uh and effectively
it uh in in a number of software
development I would assume
um that that's still true uh but so
effectively
what engineering does is really
describes the inherent risk of customers
and sells them a safer product and
um and we need to do more of that and
and the only way really to do that is to
put good statistics together to sell the
security in the product
um you know to the owner so they
understand the implications of it much
better if the customer chooses a less
safe product the computer the company
refuses to transact or contractual agree
agreements should absolve the
engineering company of responsibility so
the known liability is explicitly
accepted by the customer and if they had
to sign that contract then I think that
might be a different different issue
address risk in software so
one one process for doing this
goes to the following stages identify
the process project type and its direct
and extended stakeholders two identify
the task per phase of this upper
development project
three use structured questions to
develop a map of associations between
each task and its related stakeholders
and four analyze risk discovered by the
mapping in order to articulate the
severity of the project risks and the
risk treatment strategy
uh some of the important metrics related
to this is how much in advance you can
see that a failure is going to happen
that's really the idea of certainty
how well the the risk is understood and
known controllability is your ability to
control harm so something happens but
can you control it after the you know
after the fact and then severity is is
basically what we're used to which is
considers the level of harm done the
scale and its future impact
now what engineering does if you look at
for example
um I think this actually comes from
quite a few years ago they may have
changed it but safer cars for example
they first developed safety goals and
then from the safety goals they defined
functional safety requirements and from
the functional safety requirements they
develop technical safety requirements so
basically the technicals you know the as
an industry group they're putting
together functional safety requirements
which then when it goes to the
individual company those become
technical safety requirements and then
of course there's always verification
which ensures compliance of the design
now let's look at the highest level
which is a societal concern and here
um we're looking at
a philosophical theories okay so so
basically it includes utilitarianism
Theory
which tries to it act and basically it
tries to make the most people happy as
possible
deontological ethics which is similar to
The Golden Rule if you want to others as
you would have them doing to you and
what's important there is the motive for
your actions
and then there's virtue ethics which is
concerned about the character of an
anti-entity and on avoiding avoiding
bikes so virtue ethics can also be apply
to the organizational level
by improving in internal organizational
qualities
uh so if we think about
um I think this the scenarios here
um I actually
first did a part of this presentation to
um some businessmen and the year I did
it which was about two years ago
California had just gone through some
horrendous fires where 12 000 lightning
strikes in three weeks sparked almost
two dozen major fires and
um you know five million Acres Burns
destroyed homes thousands fleeted so
most recently I've also talked to people
from someone from Puerto Rico who
basically has moved from there because
Hurricane Katrina
which was a long time ago now they just
have not recovered they they just
um you know they have not recovered and
she eventually gave up and moved away
so the key practices train and think in
ethics manage considering the societal
impact of decisions discuss the societal
impact of risk qualitatively and
evaluate the impact of risk
quantitatively and let's go through some
of those train and think in ethics I
really talked about those three ethical
um you know philosophy shall we say and
I think the one
um that I'm going to expand on a little
bit is the deontological and that is you
know it says Universal application doing
to others and really
um uh
what they say is can't any moral
Behavior be done by everyone in the
world and and effectively an example
there is is lying does society work if
if everyone lies and
um we're actually going to find out the
result of that
unfortunately possibly very soon and
we're seeing the effects of that right
now
so adopt a code of ethics that addresses
societal concerns now we've talked about
the code of ethics before in the
self-protection and the self-protection
is work loyally with management now I I
didn't put actually this particular one
is in each one of the levels but I want
to contrast them here so self-protection
work loyally with management
compliance concern would potentially in
addition to that add obey the laws and
meet contracts carefully if you were at
stakeholder concern you're going to say
treat the customers vendors and
employees with respect and if you're at
the societal concern level which is a
part of where IEEE and ACM are if you
look at at their code of ethics this ACM
says the public good is always the
primary very consideration so you can
see there that um
you know ACM and IEEE actually are at
the societal concern level
discuss the societal impact of risk
qualitatively
um so again think outside the engineer
role
consider societal risk broadly in other
words you know we tend to think only of
the business we need to open that up to
think more more broadly one way of doing
that is to
um you know is normally we calculate
risk just actually I think that's coming
up so maybe I shouldn't talk about it
but
um
we look at risk only from the
perspective of an organization right as
people we look at risk from a personal
perspective and I think if we think
about whether we're buying
um whether we are buying antivirus
software or we are by buying
um uh
insurance for ourselves
for
um
um for our identity identity theft okay
many of us are not um are not are not
ascending there I think okay so the last
one is avoid ignoring undesirable
decisions so here's the slide that
really kind of shows the personal level
of the organizational level and the
society level and
um and so
addressing all three and I think one of
the interests that I've got is to look
at it from a publication level at least
from from the society level
uh so this is the whole thing
um the conclusion for the benefits for
this is that the lower levels to the
compliance certainly there's more
stability there's fewer lawsuits there's
rare regulatory judgments and improved
Community reputation but if we look at
the higher levels which are not quite so
popular with business is that there's
new products potentially revolutionary
and um and I think we're seeing that
with a number of forward-thinking
organizations there's better customer
relationships better long-term employee
vendor relationships long-term Community
respect and a feeling of pride in
Goodwill
so
um one thing I'm asking is that if there
there is a survey and unfortunately I
there is okay so basically the the
www.thebottom one the word doc
um ethical risk that will bring you to
um kind of some questions that I have
formulated
um uh that can help you analyze where
you are one of the things that actually
let me go back to here there's there's
really four questionnaires and one of
them is for risk people another one is
for management another one's for
compliance or legal and the other ones
for development and Engineering so so
there are surveys there and uh you could
actually help me publish in this area if
you want to take one of those surveys
unfortunately I should have a link that
goes to a page where you can easily
click on this as opposed to copying down
all those alphabet but unfortunately I
don't have that so
um so basically if you want to pick one
if you're out in Industry
the best one that fits you and kind and
fill that and the one thing I would say
is that would help it is anonymous
and yes I have some people taking
pictures of it please do that would be
wonderful
and uh
and please do fill that in and that will
help me figure out where organizations
kind of are doing well where they may
not be doing quite so well
and yeah so are there any questions
yeah
so sometimes could it be to be focused
on the wrong area unless for the example
with the uh Three Mile Island which I
actually grew up in that area so I'm
very familiar with
instead of focusing on oh my gosh look
what happened at the new
plant could it be that we should have
focused on
Oh My Gosh Look What happens when the
YouTube Donuts because that's
uh accident and
maybe that's part of the problems we're
having with medical
that's a good question
yeah that's a good question I'm not so
sure I think a lot of people eat donuts
and I don't know if that all goes into
becomes a disaster so maybe there's
something about something else other
than the donuts you know well maybe what
they did is eating at the controls as
opposed
with sugar no the
Morning Light
provide a particular
problems
yeah no that's actually really what
happened is um
the council was here at his stomach
well you know what maybe then what
should be done is that they have a table
where they can put things down that
doesn't have controls on it or things
you know and then because unfortunately
people are always going to continue to
eat or do whatever particularly if
they're working overtime and that kind
of stuff so so in the engineering of it
it's also possible to address that but
but it's an interesting question yeah
other ideas other questions or
comments yeah is it possible to get some
of these slides interested in the one
where you've added your group down
the different four levels compared to
the other Frameworks and then also
better
um you know I I
um I right now I have
www.w.cs.uwp.edu staff linky ethical
risk okay now
um the last two days have been a
disaster for me my harness broke I was I
wanted to go to this conference
I'm not sure okay it's over five minutes
oh okay okay thank you
um so unfortunately I didn't get this
updated there but I will go home and get
this updated to
www.cs.uwke staff linky ethical risk I
will have it I will have it up there if
you want to get these slides you can you
can get them there it's just that
um unfortunately in the last two days
have been a disaster for me so
um
the survey links are not but I will put
them on there you know I mean maybe
that's what I should do I can probably
get them on there
um and and just make it easy for you
right now you can download some of those
questions but I think actually the
survey are updated from what is actually
even on on
uh
yeah so yeah
other questions I think there was one
over here go ahead yeah so I saw that
you had a hazard versus outrage how do
we
operation how do we how do you engage
that
they don't they don't really go into the
outrage they do have
um what he does to document are about
eight or nine different things that
cause outrage okay and I love I
mentioned three of them if it's
life-threatening
um if there's some moral issues and if
you can't control it okay
um then it it leaves it leads to outrage
but there's actually eight of them about
about seven or eight of them that salmon
talks about
yeah yeah there's something that might
help measure that so if you've heard of
Douglas Hubbard and how to measure
anything in cyber security risks
um he gives a great methodology on how
to become a good estimator for risk
things I think it could be applied to
outrage just as well as the other risk
elements what was her name uh it's uh
Douglas Hubbard how to measure anything
in cyber security risk
one of the things that's interesting in
fact I I probably would it might be
interesting for us to talk afterwards
because it sounds like you have some
additional insights here that would be
good for me to note yeah so
um
but if you really think of of security I
think one of the issues is very often
people's lives are not impacted you know
their life and death they're not life
and death situations which is why people
haven't taken it you know they haven't
taken it seriously but I think once it
starts getting into cars and you know I
mean it's it's really seriously in cars
where there's
um then then all of a sudden the life
and death will
it will become much more of an impact
yeah what do you think would be a better
approach when you're dealing with uh
morality is across like societal
morality across the world where there's
different
widely different variant views and if
you have an international business team
just go to one extreme or whatever the
most extreme is and you take an average
of it
okay so the question is is you know
because the world has flooded the
reviews
what you know where do you
where should you shoot for I think okay
and and maybe I'm not going to answer
that the way you're expecting but let me
try and then you can ask again
um I I think companies need to specify
what their goals are and then live by
those goals and raise the values you
know because it is true that in many
parts of the world
um
fraud is mostly you know friends you
know what I do with friends so it's it's
corruption more than anything else
whereas the United States it's more
asset and misappropriation and
um uh and so effectively
um
it's it it's it's really important to
put people in a place that can lead by
example
um and understand what the problems are
in most different societies
does that answer your question or did
you have a yeah
it's better to pick just the general
standpoint of whatever
your business decided okay
morality would be as opposed to try to
take a general Sam okay so I think there
is a there is another uh question a lot
of times management wherever management
is particularly top management that's
where the organization is right I mean
whatever level the plot management is at
that's where the organization is and so
what happens if you're at a higher level
than them you know and part of what I'm
talking about in this is how you can
move things at least a little bit you
know that you understand our
organizations at this level how do I
move it up a little bit uh
and and so some of it is communicating
so you can look at your particular you
know where my organization is and then
how I move it up is you know by
communicating better or
um or or you know or by not being as
concerned because it's management it's
prerogative at the very lowest level so
um or by potentially talking about
things you know I mean instead of
talking about societal values I mean
each one of these bubbles are good right
I mean you can't just go to societal
level you have to you know you have to
you have to go to
compliance first and then you go to you
know valuing your customers and then you
go to societal values potentially
um I mean it is possible to to move
people a little bit but really when it
comes right down to it all of these all
of these are important and um and so you
kind of have to see where your
organization is and very often the um
um
[Music]
the code of ethics will tell you exactly
where it is
he from the code of ethics exactly where
your organization is so okay I think our
time is up right no we haven't no
yeah it's it okay time to go okay thank
you
foreign