Ethics, Deterrence Model & Professional Certifications
Technical guardrails alone cannot prevent insider misconduct. In this final lesson of the Apex Global Bank masterclass, we study how behavioral science, deterrence theory, and professional codes of conduct prevent unauthorized human actions.
Apex Bank Scenario 4.2
The Rogue Trader & Insider Threat
A quantitative analyst on the Apex foreign exchange trading desk develops an algorithm that hides unhedged risky bets inside off-ledger accounts. The analyst knew the bank policy forbade unauthorized trade concealment, but calculated that the chances of being audited were low due to weak peer review.
1. The 3 Primary Causes of Unethical Behavior
1. Ignorance: The employee did not know the rule existed (remedied via mandatory security awareness training and explicit policy dissemination).
2. Accident: Human error or systemic cognitive overload (remedied via automated guardrails, UX friction, and privileged access workflows).
3. Intent: Willful disregard of rules driven by malice, financial greed, or ego (remedied exclusively via the Deterrence Model).
2. The Deterrence Model: 3 Mandatory Conditions
Criminological and behavioral research shows that laws and policies only deter misconduct if all three conditions exist simultaneously:
1
Fear of Penalty
The consequence must be severe enough to outweigh the perceived benefit (e.g., immediate termination, criminal prosecution, loss of professional certification).
2
Probability of Apprehension
The offender must believe they will be caught (e.g., real-time SIEM logging, immutable audit trails, active behavioral analytics).
3
Probability of Penalty Being Applied
The offender must know that enforcement is inevitable and swift (no exceptions for high-performing executives or senior engineers).
⚠️ Critical Takeaway: If any single pillar is missing, deterrence collapses. Even the death penalty will not deter a criminal if they believe the probability of being caught is zero.
3. Professional Certification Bodies & Codes of Ethics
Security leaders at Apex Global Bank adhere to professional codes of ethics that transcend company allegiance:
(ISC)² Code of Ethics:"Protect society, the common good, necessary public trust, and infrastructure. Act honorably, honestly, justly, responsibly, and legally."
ISACA: Enforces standards for IT auditors (CISA) and security managers (CISM), requiring objective independence.
ACM / IEEE-CS Software Engineering Code: Directs software engineers to accept full responsibility for their work and approve software only if it has a well-founded belief that it is safe, meets specifications, and passes tests.
4. Final Knowledge Check
Checkpoint Quiz: The Deterrence Model
Apex Bank introduces a policy stating that anyone copying customer data to a flash drive faces immediate termination and referral to the FBI. However, the bank disables DLP monitoring and never reviews endpoint USB insertion logs. Why does this policy fail to deter insider theft?