Code of Ethics Across Both Humans and AI

Gaining privileged access is the Holy Grail for both penetration testers and cybercriminals. Privileged access is granted to specific users as part of their job function to develop and maintain systems, manage data resources, and support users. Users with privileged access are often required to sign a Code of Ethics, outlining guidelines for appropriate use, such as not exploiting access to read users' files, without a legitimate reason, and not attempting to use privileged access to gain access to unauthorized systems. While a Code of Ethics can be fairly prescriptive, users with privileged access are also expected to use good judgement to navigate grey areas. The decision by users to exploit privileged access comes down to ethics - a characteristic of sentient beings. Despite the current hype, AI is not sentient and does not take actions based on a code of ethics. AI takes actions based on the parameters of the prompts provided, free of moral dilemma about the potential consequences of those prompts. This talk provides examples of situations where human insight and ethics were used to make a decision to protect the confidentiality, integrity, and availability of systems. Key Takeaways: For both human and AI access, understand: (1) Scope of access; (2) auditing access; and (3) termination of access.