IT Ethics and Cybersecurity

Corporate social responsibility (CSR) is a business's commitment to operate ethically and contribute to society, the environment and the economy, beyond just making profit, by considering the impact of its activities on employees, customers, communities and the environment.

Professionalism in IT means following ethical standards, competence and accountability in work. It builds public and client trust, ensures quality, honesty and confidentiality of data, and reduces harm from errors or misuse of technology.

Copyright protects the original expression of an author's work (software code, books, music, designs) automatically on creation, usually for the author's life plus a number of years. Patents protect new, useful and non-obvious inventions or processes (the idea or method), granted only after registration and examination, for a limited period (about 20 years).

The main concern is the unfair treatment of contingent (temporary or contract) workers: they usually get lower pay, no benefits or job security, and are used to avoid the employer's obligations to regular employees. There is also the risk of exploitation and disclosure of confidential information.

White-hat hackers are ethical hackers who, with permission from the owner, test systems and networks for weaknesses so that these can be fixed before malicious attackers exploit them.

Physical security protects the hardware, servers, network equipment and storage media from theft, damage, tampering and unauthorized access. If an attacker can reach the device, software controls such as passwords and firewalls can be bypassed, so physical security is the first layer of protection for data.

They can be prevented by training and awareness of employees, verifying identity before sharing information, not clicking unknown links or attachments, using multi-factor authentication, strong clear security policies, spam and email filtering, and reporting suspicious requests.

Digital evidence (logs, files, emails, device data) is used to identify what happened in a cyber incident, trace the offender, prove the crime in court and support recovery and prevention. It must be collected so that its integrity and chain of custody are preserved.

The Electronic Transactions Act, 2063 (2008) of Nepal gives legal recognition to electronic records, digital signatures and online transactions, regulates certifying authorities, and defines and punishes computer and cyber offences, so that e-commerce and e-governance can work in a secure, trusted legal framework.

Whistle-blowing is the act of an employee or insider reporting illegal, unethical or harmful activity within an organization to management, authorities or the public.

Ethics is the set of moral principles and values that guide people on what is right and wrong in their behaviour and decisions.

Importance in business

• Builds trust and a good reputation among customers, investors and the public.
• Prevents fraud, corruption and legal penalties.
• Improves employee morale, loyalty and productivity.
• Supports long-term sustainability and profit, and gives a fair basis for decision making.

Organizations can encourage ethical use of IT resources by:

• Creating and communicating a clear acceptable use policy and code of ethics, with signed acknowledgement.
• Regular training and awareness programmes on security, privacy and misuse.
• Monitoring and auditing system use, with clear disciplinary action for violations.
• Setting an example through management leadership and rewarding ethical behaviour.
• Providing safe channels for reporting misuse (whistle-blowing) and applying access controls.

A trade secret is confidential business information that gives a company a competitive edge and is kept secret by reasonable effort, such as formulas, source code, customer lists, algorithms, manufacturing processes or marketing plans. Examples are the Coca-Cola recipe and Google's search algorithm.

How they help businesses

• They protect valuable know-how without registration or time limit, as long as secrecy is kept.
• They preserve competitive advantage, as rivals cannot copy the information.
• They are protected by non-disclosure agreements and law against theft and breach of confidence, and they save the cost of patent filing.

In social engineering, the attacker first builds trust with the victim so that the victim willingly gives information or access. The attacker pretends to be a trusted person, such as a colleague, bank officer, IT support or manager, uses a friendly manner, correct names and internal jargon, shows urgency or authority, and may talk or interact over time (rapport). Once the victim trusts the attacker, he or she shares passwords, clicks malicious links or allows entry. Trust is the weakness being exploited, not a technical flaw, so verification of identity is the main defence.

Economic model shifts, such as the move from selling products to subscription, cloud, pay-per-use and platform or data-driven business models, change where value and risk lie. They affect cybersecurity development in these ways:

• Valuable data and online services become the main assets, so more is invested in protecting them.
• The cybercrime economy (ransomware-as-a-service, data selling) forces stronger defences and security as a service.
• Cloud and subscription models make security a continuing operating cost rather than a one-time purchase, with security providers and cyber insurance growing.
• Costs of breaches and regulation push firms to build security into products by design.

IoT devices pose risks to personal security because they often have weak or default passwords, rarely receive firmware updates, and have limited built-in security. Attackers can take control of cameras, smart speakers or locks, spy on the user, steal personal data, use them as a way into the home network, or join them into botnets (such as Mirai) for DDoS attacks. Unencrypted communication and excessive data collection also threaten privacy.

Social engineering is the psychological manipulation of people to make them reveal confidential information, give access or perform actions that compromise security, instead of breaking in through technical means. Common forms are phishing, pretexting, baiting, tailgating, vishing and impersonation.

Why it is a major threat

• It targets the human factor, which is the weakest link, so firewalls and antivirus cannot stop it by themselves.
• It is cheap, easy and needs little technical skill, yet highly effective.
• It exploits trust, fear, urgency, curiosity and helpfulness.
• It is often the first step of larger attacks such as ransomware, data breaches and fraud.
• It is hard to detect because requests look legitimate, and a single successful attack can give access to the entire network.
• Information on social media makes targeted attacks (spear phishing) easy.

Defence needs awareness training, verification procedures, multi-factor authentication and clear security policies.

Green computing means designing, developing and using IT in an energy-efficient and environmentally friendly manner. Organizations can include it in every phase of the software development life cycle (SDLC).

1. Planning and requirements: include energy and resource efficiency as a non-functional requirement; assess the carbon footprint; decide whether the software is needed at all.
2. Design: choose energy-efficient architecture, such as lightweight and modular design, efficient algorithms and data structures, reduced data transfer, and cloud or virtualization to share servers.
3. Development: write efficient code (avoid wasteful loops and polling), use low-power languages and libraries, minimise memory and CPU use, and use energy-profiling tools.
4. Testing: measure power consumption and performance, and remove inefficient parts; use virtual test environments instead of many physical machines.
5. Deployment: host in energy-efficient or renewable-powered data centres, use auto-scaling and virtual machines, and reduce idle servers.
6. Maintenance and disposal: optimise and update code regularly, remove unused features and data, and recycle hardware responsibly (e-waste).

Also, train developers, adopt green policies and measure with energy metrics. The benefits are lower electricity cost, reduced emissions, longer hardware life and better corporate image.

Legal perspective of cybercrime in Nepal

Nepal has no single comprehensive cyber-security code, and cybercrime is dealt with mainly by the Electronic Transactions Act, 2063 (2008), with support from the Constitution (right to privacy), the Penal Code 2074 (for example defamation, fraud, obscenity), the Individual Privacy Act 2075, the Copyright Act, and the Telecommunications Act. Cyber offences include unauthorized access to computers, destroying or altering computer source code, damaging data, publishing illegal or obscene material electronically, fraud through computers, breach of confidentiality and false digital signatures. Punishments are fines and imprisonment (for example up to 5 years imprisonment and fines of up to Rs 200,000 for some offences). A Cyber Bureau of Nepal Police investigates, and the IT Tribunal hears cases and appeals. The Act is considered old, and a new Information Technology and Cyber Security Bill has been proposed to cover new crimes such as social media abuse and data protection.

Significance of the Electronic Transactions Act

• Gives legal validity to electronic records and digital signatures, enabling e-commerce and e-governance.
• Provides for the Controller of Certifying Authorities and licensing of certifying authorities to ensure trust.
• Defines cyber offences and penalties, thus deterring crime.
• Creates the IT Tribunal and investigation mechanism for resolving disputes.
• Protects the confidentiality and integrity of electronic communication, giving users and businesses confidence in online transactions.

Trademark infringement is the unauthorized use of a trademark (name, logo, slogan or symbol) that is identical or confusingly similar to a registered mark, on goods or services, so that consumers may be misled about their source. Online examples are using a brand's logo on a fake website, counterfeit products on e-commerce platforms, or using another firm's mark in keywords and metatags.

Cybersquatting is registering, selling or using an Internet domain name that is the same as or similar to a well-known brand or person's name, in bad faith, usually to sell it to the owner at a high price, to divert traffic or to mislead people. Related practices are typosquatting (for example gooogle.com). It is dealt with through the UDRP of ICANN/WIPO and national trademark law (in the US, the Anticybersquatting Consumer Protection Act).

Impact on businesses

• Loss of sales and traffic, dilution of brand value and reputation.
• Cost of legal action, buying back domain names and monitoring.
• Difficulty in registering the desired domain.

Impact on consumers

• Confusion and deception, buying poor-quality or fake goods.
• Phishing and fraud through look-alike sites, theft of personal and financial data.
• Loss of trust in online shopping.

1. Working together against cybercrime

• Intellectual property (IP) laws (copyright, patents, trademarks, trade secrets, and in Nepal the Copyright Act and Patent, Design and Trademark Act) give legal ownership of digital assets such as software, content, databases and brands, and make piracy, unauthorized copying, counterfeiting and cybersquatting offences.
• Cybersecurity regulations (Electronic Transactions Act, privacy laws, data protection and standards like ISO 27001) require organizations to protect systems and data with technical and organizational controls, report breaches, and punish hacking, data theft and malware.
• Together they: define what is protected and who owns it (IP) and how it must be protected (security rules); provide criminal and civil remedies; deter theft of trade secrets and source code; support enforcement through digital forensics; and promote controls such as encryption, access control, DRM, licensing, watermarking and audits. International cooperation (WIPO, Budapest Convention) helps with cross-border cases.

2. Methods for collecting, seizing and protecting digital evidence

Collection and seizure

• Identify and secure the scene; isolate devices from networks to prevent remote changes (but avoid shutting down volatile systems carelessly).
• Capture volatile data first (RAM, running processes, network connections), then non-volatile data.
• Create a forensic image (bit-by-bit copy) using write blockers, and work only on the copy.
• Collect logs, emails, cloud data, mobile data and network traffic; take photographs and notes.
• Obtain legal authority (warrant or consent) before seizure.

Protection

• Compute hash values (MD5/SHA-256) to prove integrity.
• Maintain a documented chain of custody recording who handled the evidence, when and why.
• Label, seal and store in secure, controlled storage, with access logs and encryption.
• Use accepted forensic tools and procedures, and analyse the copy only, with full documentation for court.

3. Challenges

• Volatility and ease of alteration or deletion of digital data.
• Huge volume of data and variety of devices and formats.
• Encryption, anti-forensics and password protection.
• Cloud and cross-border jurisdiction; different laws and slow mutual legal assistance.
• Maintaining chain of custody and proving authenticity and admissibility in court.
• Privacy rights and legal limits on search and seizure.
• Lack of trained forensic experts, tools and laboratories (especially in developing countries), and rapidly changing technology.

1. Risks that cybersecurity mitigates

• Malware and ransomware: viruses, worms and trojans that damage systems or lock data for ransom.
• Phishing and social engineering: deception to steal credentials or money.
• Data breaches and identity theft: exposure of personal, financial or business data.
• Denial-of-service attacks: loss of availability of services.
• Insider threats: misuse by employees, accidental or malicious.
• Financial fraud and theft, and intellectual property theft or espionage.
• Legal and compliance penalties, reputation and customer trust loss, and operational disruption.
• Third-party and supply-chain, cloud and IoT risks, and attacks on critical infrastructure.

2. Case: data breach through an outsourced IT vendor

Risks in outsourcing IT operations

• Loss of direct control over data and systems; the vendor may have weaker security.
• Unauthorized access by vendor staff (insider threat) and excessive privileges.
• Data leakage in transit or storage, and unclear data location and jurisdiction.
• Subcontractors (fourth parties) and supply-chain compromise.
• Weak contract terms: no security obligations, audit rights or breach notification.
• Compliance failure (privacy law, regulation) for which the client remains responsible.
• Poor incident response, service disruption, vendor lock-in and difficulty recovering data on exit.

Strategies to mitigate

1. Due diligence: assess the vendor's security posture, certifications (ISO 27001, SOC 2), references and history before selection.
2. Strong contracts and SLAs: define security requirements, data ownership, confidentiality (NDA), breach notification times, liability, right to audit, and subcontractor rules.
3. Access control: least privilege, multi-factor authentication, role-based access, and monitoring of privileged accounts.
4. Data protection: classify data, share only what is needed, encrypt at rest and in transit, mask sensitive data, and keep backups.
5. Continuous monitoring and audits: periodic security assessments, penetration tests, log review and vendor risk scoring.
6. Incident response: joint response plan, clear roles, and the ability to contain and report breaches.
7. Training and compliance: awareness of the vendor's staff and compliance with applicable laws.
8. Exit plan: secure return or destruction of data and revocation of access at the end of the contract.
9. Cyber insurance and business continuity planning to reduce the financial impact.

In this case, the company should first contain the breach, investigate, notify those affected and authorities as required, then strengthen the contract and controls as above.