  Research into the ethics of cybersecurity is an established and growing topic
of investigation, however the translation of this research into practice is
lacking: there exists a small number of professional codes of ethics or codes
of practice in cybersecurity, however these are very broad and do not offer
much insight into the ethical dilemmas that can be faced while performing
specific cybersecurity activities. In order to address this gap, we leverage
ongoing work on the Cyber Security Body of Knowledge (CyBOK) to help elicit and
document the responsibilities and ethics of the profession. Based on a
literature review of the ethics of cybersecurity, we use CyBOK to frame the
exploration of ethical challenges in the cybersecurity profession through a
series of 15 interviews with cybersecurity experts. Our approach is qualitative
and exploratory, aiming to answer the research question "What ethical
challenges, insights, and solutions arise in different areas of
cybersecurity?". Our findings indicate that there are broad ethical challenges
across the whole of cybersecurity, but also that different areas of
cybersecurity can face specific ethical considerations for which more detailed
guidance can help professionals in those areas. In particular, our findings
indicate that security decision-making is expected of all security
professionals, but that this requires them to balance a complex mix of
technical, objective and subjective points of view, and that resolving
conflicts raises challenging ethical dilemmas. We conclude that more work is
needed to explore, map, and integrate ethical considerations into cybersecurity
practice; the urgent need to conduct further research into the ethics of
cybersecurity AI; and highlight the importance of this work for individuals and
professional bodies who seek to develop and mature the cybersecurity profession
in a responsible manner.
