Risk Assessment and Knowledge Management of Ethical Hacking In
Total Page：16
File Type：pdf, Size：1020Kb
Technoethics and Sensemaking: Risk Assessment and Knowledge Management of Ethical Hacking in a Sociotechnical Society by Baha Abu-Shaqra A thesis submitted in partial fulfillment of the requirements for the degree of Doctor of Philosophy in Electronic Business Faculty of Engineering University of Ottawa © Baha Abu-Shaqra, Ottawa, Canada, 2020 ii Abstract Cyber attacks by domestic and foreign threat actors are increasing in frequency and sophistication. Cyber adversaries exploit a cybersecurity skill/knowledge gap and an open society, undermining the information security/privacy of citizens and businesses and eroding trust in governments, thus threatening social and political stability. The use of open digital hacking technologies in ethical hacking in higher education and within broader society raises ethical, technical, social, and political challenges for liberal democracies. Programs teaching ethical hacking in higher education are steadily growing but there is a concern that teaching students hacking skills increases crime risk to society by drawing students toward criminal acts. A cybersecurity skill gap undermines the security/viability of business and government institutions. The thesis presents an examination of opportunities and risks involved in using AI powered intelligence gathering/surveillance technologies in ethical hacking teaching practices in Canada. Taking a qualitative exploratory case study approach, technoethical inquiry theory (Bunge-Luppicini) and Weick’s sensemaking model were applied as a sociotechnical theory (STEI-KW) to explore ethical hacking teaching practices in two Canadian universities. In-depth interviews with ethical hacking university experts, industry practitioners, and policy experts, and a document review were conducted. Findings pointed to a skill/knowledge gap in ethical hacking literature regarding the meanings, ethics, values, skills/knowledge, roles and responsibilities, and practices of ethical hacking and ethical hackers which underlies an identity and legitimacy crisis for professional ethical hacking practitioners; and a Teaching vs Practice cybersecurity skill gap in ethical hacking curricula. Two main S&T innovation risk mitigation initiatives were explored: An OSINT Analyst cybersecurity role and associated body of knowledge foundation framework as an interdisciplinary research area, and a networked centre of excellence of ethical hacking iii communities of practice as a knowledge management and governance/policy innovation approach focusing on the systematization and standardization of an ethical hacking body of knowledge. iv Dedication to mom and dad. v Acknowledgements If I have succeeded it is by standing on the shoulders of giants. A lot of work goes into a PhD thesis. A collective thanks to all those who contributed to the success of the thesis, and my apologies to those I cannot identify because of a confidentiality clause. It is impossible for me to express in words my gratitude to my PhD thesis supervisor, and before that my MA thesis supervisor, Professor Rocci Luppicini. I consider myself very lucky for the tremendous privilege and honour of learning from him and following in his footsteps in the field of Technoethics and the pioneering work of Mario Bunge especially with regard to technology assessment and grounding of technology in historical and theoretical context. Professor Luppicini’s constructivist approach to supervision and teaching saw him giving me wings and letting me fly. For example, the idea of “the intertwinement of technology and society in complex sociotechnical systems” and that “we do sociology” were explicitly from him. On a professional practice level, Professor Luppicini taught me the way to deal with your doubters is to try to win them over to your side. Thank you also to my distinguished thesis advisory committee members for their priceless guidance and contribution to the intellectual development of the thesis over the past four years. Special thanks to Professor Liam Peyton, my supervisor for “area two” of the interdisciplinary PhD in E-Business program. Your support made all the difference. I am infinitely grateful. Coming from the humanities and arts into an engineering discipline, I felt like a fish out of the water. Professor Peyton challenged me to step out of my comfort zone and plunge into technical scholarship on computer and network hacking. The idea of studying ethical hacking as penetration testing and the idea of interviewing “those who teach and those who practice” ethical hacking were from him. vi A special thanks also goes to Professor André Vellino, my third distinguished TAC member, whose intellectual contribution, while perhaps a bit more subtle, has undeniably advanced my research. His comments helped me connect the dots. For example, his references to “falsifiability,” “viability,” and SoK pointed me straight to the scientific method and its centrality for my thesis, as a key component of a social science approach to studying technology in society. Thank you so much. I also wish to extend a profound gratitude to the thesis examiners Professor Anabel Quan- Haase and Professor Hussein Al Osman for their very helpful feedback. Professor Quan-Haase’s many contributions to the intellectual development of the thesis included her pioneering STS textbook “Technology and society” (2016) which made it possible for me to piece it all together- -how my work (Bunge’s conception of technology as social technology/sociotechnology and social systems as sociotechnical systems) fits into the tradition of STS and SCOT. Her detailed discussion of the thesis’s contribution to the advancement of knowledge helped me appreciate the important implications of the thesis regarding theory, methods, and practice across disciplines. The most central contribution to the extant literature on hacking is that the thesis sheds light on ethical hacking meanings, theories, and social relevance, she said. My gratitude and admiration for her and her scholarship are off the charts. Professor Al Osman helped me strengthen my empirical case study analysis by pointing me to data sources that would help me better understand ethical hacking teaching practices in higher education, especially, he said I should look into the program requirements and course descriptions of software engineering for a more holistic analysis. Further, his question during the oral defence “Who should teach ethical hacking?” set me off in the right direction to plan for future career opportunities. Thank you so much. vii The author would like to thank the interview participants of this study for their generous time and expert contribution. Their participation was essential, and I am extremely grateful for their generosity in sharing their time and insights into ethical hacking teaching practices and effective governance in society. Finally, I would like to express my deepest appreciation to my loving family for believing in me and supporting me. Your help was indispensable. To my parents, brothers and sisters: Thank you from the bottom of my heart. viii Table of Contents Abstract…………………………………………………………………………….…........….ii Dedication…………………………………………………………………………………….iv Acknowledgements………………………………………………………..…………….…….v Table of Contents…………………………………………………………..…………………vii Acronyms and Abbreviations…………………………………………………………………xiv Chapter 1: Introduction……………………………………………………..…………………1 1.1. Cybersecurity Threats……………………………………….…………………….….…..4 1.1.1. Increasing cyber threat exposure………………………………………………..…..7 1.1.2. Cybercrime at the business level………………………………………..……...…..8 1.1.3. Cybercrime at the individual level……………………………….…….…..……….9 1.1.4. Surveillance: Invading privacy……………………………………….….…………9 1.1.4.1. State surveillance………………………………………….………..…….….10 1.1.4.2. Business surveillance………………………………………………………...13 1.2. Social Digitization……………………………………………………………………......18 1.2.1. Digital transformation of higher education………………..…………..…………...21 1.3. Cybersecurity Vulnerabilities……………………………..………………..………….....23 1.3.1. An open, scientific, knowledge-making society……………………..…………..…24 1.4. A Knowledge-Driven Economy…………………………………………..……………...26 1.5. A Crisis of Trust……………………………………..………..…………..…..…………..28 1.6. Thesis Rationale, Research Questions, and Theoretical Framework………………….......30 1.7. Thesis Objectives………………………………………………..………...…..…………..36 1.8. Thesis Overview…………………………………..……………..………………..……….38 ix Chapter 2: Literature Review………………………………………………….………………39 2.1. Introduction…………………………………………..…………………….………….….39 2.2. Part 1: Information Security Risk Governance…………………………..………….……40 2.2.1. Understanding information security risk……………………………………..……..42 2.2.2. Key information security risk mitigation best practices………………………..…...46 2.2.3. IT governance……………………………………..………….…………..………….48 2.2.4. Cybersecurity regulatory environment…………………………………..….……….55 2.3. Part 2: Theoretical Framework…………………………………………………………….57 2.3.1. STEI-KW as a sociotechnical theory of society: The epistemological roots………..57 2.3.2. Systemism……………………………………………………………………...……..61 2.3.3. The social construction of technology……………………………………….….…....63 2.3.4. Of an open liberal society……………………………………………………..….…..68 2.3.5. The scientific method……………………………………………………..…………..72 2.3.6. A non-justificationist theory of science…………………………………….…………73 2.3.6.1. Critical rationalism……………………………………………….……….…….74 2.3.6.2. Empirical pragmatism…………………………………………….…..…………75 2.3.7. Scientific method and trust……………………………………………………………79 2.3.8. Scientific method design