Ethics in security vulnerability research

Andrea Matwyshyn, Ang Cui, Angelos D. Keromytis, Salvatore J. Stolfo

Research output: Contribution to journalArticle

9 Scopus citations

Abstract

The authors provide the articulation of the ethical argument for the role of vulnerability researchers and security practitioners. They argue that, provided that these researchers don't themselves engage in conduct that causes harm, their conduct doesn't necessarily run afoul of ethical and legal considerations. Furthermore, creating effective defenses against cyberthreats requires vulnerability researchers and practitioners to master techniques such as network recognizance, reverse engineering, penetration testing, and vulnerability exploitation. Although some consider research employing such techniques unequivocally unethical and possibly illegal, a deep understanding in these areas is pivotal to understanding and mitigating the escalating cyberthreat. Using the case study of recent work done at Columbia University, the authors advocate for crafting a code of conduct for vulnerability researchers and security practitioners, including the implementation of procedural safeguards to ensure minimization of harm. They also propose some best practices in vulnerability research.

Original languageEnglish (US)
Article number5439532
Pages (from-to)67-72
Number of pages6
JournalIEEE Security and Privacy
Volume8
Issue number2
DOIs
StatePublished - Mar 1 2010

All Science Journal Classification (ASJC) codes

  • Computer Networks and Communications
  • Electrical and Electronic Engineering
  • Law

Fingerprint Dive into the research topics of 'Ethics in security vulnerability research'. Together they form a unique fingerprint.

  • Cite this

    Matwyshyn, A., Cui, A., Keromytis, A. D., & Stolfo, S. J. (2010). Ethics in security vulnerability research. IEEE Security and Privacy, 8(2), 67-72. [5439532]. https://doi.org/10.1109/MSP.2010.67