Ethical issue: ineffective security practices

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. An organisation stores customers' personal data. Which statement best describes its ethical duty?

A It only needs to protect the data if a law forces it to

B It has a duty of care to protect that data from preventable harm

2. A company skips security testing to save money and launch sooner. Is this an ethical issue?

A Yes, cutting security to save money puts users at risk of preventable harm

B No, saving money is always a good business decision

3. Who can be harmed when a poorly secured system suffers a data breach?

A Only the developers who wrote the code

B Users, employees, the organisation and its partners

4. A breach happens because a known patch was never applied. Why is this an ethical failure?

A The harm could have been prevented with an effective practice

B The harm was unavoidable, so nobody is responsible

5. After a breach, which action is the more ethical response?

A Promptly tell affected users so they can protect themselves

B Stay quiet to protect the company's reputation

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1duty_of_care = protect_user_data()		ABeing open after an incident by promptly telling affected people what happened so they can protect themselves
2notify_users(breach_details)		BHiding a breach is unethical because affected users cannot protect themselves. The organisation should be open and notify them.
3Cost-cutting vs security: skipping security work to save money is unethical when users bear the harm of a preventable breach		CThe organisation has an ethical duty to protect the people whose data it holds from preventable harm
4Stakeholders harmed by a breach include customers, employees and the organisation itself, so all of them must be considered		Dif budget_low: skip_security_testing()
5if breach: hide_incident()		ECutting security spending to save money ignores the duty of care. Users could be harmed by a breach that proper practices would have prevented.
6security_budget = 0 # saves money		Fharmed = [customers, staff, company]

Definitions

Ineffective security practices

Fill in the Blanks

Complete each line of code by filling in the missing parts.

if breach: ______(affected_users)

if budget _ needed: risk = "high"

___ person in affected_users: send(person)

if ___ data_encrypted: log_risk(user_data)

___ report_breach(users): notify(users)

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A breach_found = True

B if not breach_found:

C notify_users()

Question 2

A data_held = "customer records"

B duty_of_care = True

C if duty_of_care:

D ignore(data_held)

Question 3

A security_budget = 20000

B needed = 50000

C if security_budget > needed:

D warn_board()

Question 4

A harmed = ["users", "staff"

B for person in harmed:

C support(person)

Question 5

A saved = 10000

B breach_cost = 500000

C if breach_cost < saved:

D print("Not worth it")

Answer Key

Ethical issue: ineffective security practices

Section A: Quick Questions

B — It has a duty of care to protect that data from preventable harm

A — Yes, cutting security to save money puts users at risk of preventable harm

B — Users, employees, the organisation and its partners

A — The harm could have been prevented with an effective practice

A — Promptly tell affected users so they can protect themselves

Section B: Match the Pairs

duty_of_care = protect_user_data() → The organisation has an ethical duty to protect the people whose data it holds from preventable harm

notify_users(breach_details) → Being open after an incident by promptly telling affected people what happened so they can protect themselves

Cost-cutting vs security: skipping security work to save money is unethical when users bear the harm of a preventable breach → if budget_low: skip_security_testing()

Stakeholders harmed by a breach include customers, employees and the organisation itself, so all of them must be considered → harmed = [customers, staff, company]

if breach: hide_incident() → Hiding a breach is unethical because affected users cannot protect themselves. The organisation should be open and notify them.

security_budget = 0 # saves money → Cutting security spending to save money ignores the duty of care. Users could be harmed by a breach that proper practices would have prevented.

Section C: Definitions

Ineffective security practices — An ethical issue: people whose data is held can be harmed by a breach the organisation could have prevented, so it has a duty of care to protect them and be open if it fails.

Section D: Fill in the Blanks

if breach: notify(affected_users)

if budget < needed: risk = "high"

for person in affected_users: send(person)

if not data_encrypted: log_risk(user_data)

def report_breach(users): notify(users)

Section E: Spot the Error

B — This only notifies users when there is no breach. Users whose data was exposed must be told, so the condition should be 'if breach_found:'.

D — An organisation holding people's data has a duty of care to protect it. The call should be protect(data_held), not ignore(data_held).

C — The board should be warned when the security budget is LESS than what is needed (cost-cutting). The operator should be <, not >.

A — The list is missing its closing square bracket. It should end with ] so the stakeholders harmed by a breach are stored correctly.

C — Cutting security is not worth it when a breach costs MORE than the money saved. The test should be breach_cost > saved.