In today’s digital age, organizations of all sizes handle vast amounts of data that require stringent protection. Data breaches can be costly, both financially and reputationally, making it crucial to understand the vulnerabilities that exist throughout the data lifecycle.

What is the Data Lifecycle?

The data lifecycle is a model that outlines the different stages data goes through within an organization, from its creation to its eventual disposal. Understanding this lifecycle is fundamental to implementing effective security controls.

Stages of the Data Lifecycle:

1. Collect: This is where data is gathered from various sources, both internal and external.
2. Store: Data is stored in various systems, including databases, cloud storage, and physical devices.
3. Use: Data is accessed, processed, and analyzed for different purposes.
4. Archive: Data that is no longer actively used but needs to be retained is archived.
5. Destroy: Data is securely disposed of when it is no longer needed.

Data Governance: The Key to Data Protection

Data governance encompasses the policies and procedures that dictate how an organization manages its data. Effective data governance ensures data privacy, accuracy, availability, and security throughout its lifecycle.

Key Roles in Data Governance:

• Data Owner: The person responsible for deciding who can access, edit, use, or destroy data.
• Data Custodian: The person or entity responsible for the safe handling, transport, and storage of data.
• Data Steward: The person or group that maintains and implements data governance policies.

Protecting Data at Every Stage

Organizations should have comprehensive data governance policies that outline procedures for protecting data at each stage of its lifecycle. These policies should address access control, data encryption, data masking, and other security measures.

Legally Protected Information

Certain types of data require extra protection due to legal and regulatory requirements. These include:

• Personally Identifiable Information (PII): Information that can be used to identify an individual, such as name, address, and social security number.
• Protected Health Information (PHI): Information related to an individual’s health, regulated by HIPAA in the U.S. and GDPR in the EU.
• Sensitive Personally Identifiable Information (SPII): Highly sensitive PII that requires strict access controls, such as bank account numbers and login credentials.

Key Takeaways

• Protecting data is crucial for maintaining privacy and security.
• Data governance policies provide a framework for managing data throughout its lifecycle.
• Data custodians play a vital role in ensuring data security.
• Understanding the different types of sensitive data and their legal protections is essential.

By implementing robust data governance policies and security controls, organizations can effectively protect their data and mitigate the risk of

In today’s data-driven world, understanding the interplay between security and privacy is paramount. While often used interchangeably, these two concepts have distinct meanings and implications.

Information Privacy vs. Information Security

• Information privacy focuses on giving individuals control over their personal data and how it’s used and shared.
• Information security (InfoSec) encompasses the measures taken to protect data from unauthorized access, use, disclosure, disruption, modification, or destruction.

Essentially, privacy is about respecting individual choices regarding their data, while security provides the means to enforce those choices.

Why Privacy Matters in Security

The rise of the internet and data collection practices in the late 1990s sparked concerns about data privacy and security. As organizations collected and utilized increasing amounts of personal data, the potential for misuse and breaches grew. This led to a global dialogue on data protection and the need for clear regulations.

Notable Privacy Regulations

Several regulations have emerged to address data privacy and security concerns:

• General Data Protection Regulation (GDPR): This EU regulation gives individuals control over their personal data and applies to any organization handling data of EU citizens or residents, regardless of the organization’s location.
• Payment Card Industry Data Security Standard (PCI DSS): This standard aims to protect credit and debit card data from theft and fraud.
• Health Insurance Portability and Accountability Act (HIPAA): This U.S. law mandates the protection of sensitive patient health information.

These regulations have significantly influenced data handling practices worldwide, setting standards for data protection and privacy.

Security Assessments and Audits

Organizations use security assessments and audits to ensure compliance with regulations and maintain strong security postures:

• Security Audit: A comprehensive review of an organization’s security controls, policies, and procedures against a predefined set of standards or regulations.
• Security Assessment: An evaluation of the effectiveness of existing security measures in protecting against threats.

Security audits are typically conducted less frequently (e.g., annually), while security assessments are more frequent (e.g., every 3-6 months). Both are crucial for identifying vulnerabilities and ensuring compliance.

Key Takeaways

• Privacy and security are distinct but interconnected concepts.
• Data privacy regulations play a critical role in protecting personal information.
• Organizations must comply with relevant regulations to maintain customer trust and avoid penalties.
• Security assessments and audits help organizations evaluate and improve their security posture.

By prioritizing data privacy and adhering to relevant regulations, organizations can demonstrate their commitment to protecting sensitive information and build trust with their customers.

Encryption is the cornerstone of data security, transforming information into an unreadable format to protect it from unauthorized access. But did you know there are different types of encryption? Let’s explore the two main categories: symmetric and asymmetric encryption.

Types of Encryption

• Symmetric Encryption: This method uses a single secret key to both encrypt and decrypt data. Both the sender and receiver must possess this key, making key management crucial.
• Asymmetric Encryption: This approach utilizes a pair of keys: a public key for encryption and a private key for decryption. The public key can be widely distributed, while the private key is kept secret.

The Importance of Key Length

The length of the encryption key significantly impacts security. Longer keys offer greater protection against brute-force attacks, where attackers try to guess the key through trial and error. However, longer keys can also lead to slower processing times. Balancing security and performance is a key consideration in encryption.

Approved Algorithms

Many applications use a combination of symmetric and asymmetric encryption to achieve optimal security and performance. Here are some widely used algorithms:

Symmetric Algorithms

• Triple DES (3DES): A block cipher that applies the DES algorithm three times, using three different keys. While still in use for backward compatibility, it has limitations in terms of data encryption capacity.
• Advanced Encryption Standard (AES): One of the most secure symmetric algorithms available, with key lengths of 128, 192, or 256 bits. It is widely adopted due to its strong security and efficiency.

Asymmetric Algorithms

• Rivest Shamir Adleman (RSA): One of the first asymmetric algorithms, used to protect highly sensitive data with key lengths of 1,024, 2,048, or 4,096 bits.
• Digital Signature Algorithm (DSA): A standard asymmetric algorithm often used in conjunction with RSA in public key infrastructure (PKI).

Generating Keys

Tools like OpenSSL can be used to generate public and private keys for these algorithms. OpenSSL is an open-source command line tool commonly used to verify digital certificates in PKI.

Obscurity is Not Security

A fundamental principle in cryptography is Kerckhoff’s principle, which states that a cryptosystem should be secure even if everything about the system, except the key, is public knowledge. This¹ emphasizes the importance of robust algorithms rather than relying on secrecy.  pursuit.unimelb.edu.au

Encryption is Everywhere

Encryption is pervasive in today’s digital world. Websites often use asymmetric encryption to secure sensitive data like login credentials, while symmetric encryption is used for faster secure communication during a user’s session.

Regulations like FIPS 140-3 and GDPR mandate specific data protection measures, including encryption. Compliance with these regulations is essential for organizations to demonstrate responsible data handling practices.

By understanding the different types of encryption and their applications, you can appreciate the crucial role encryption plays in safeguarding data and ensuring privacy in the digital age.

Ethics has become an increasingly critical consideration in contemporary organizational and business life. Businesses tend to function in increasingly complex, globalized, and technology driven environments. This has caused the expectations that are placed upon leaders and employees to act responsibly to have magnified greatly. Ethical failures can cause damage to reputations, wear away trust, and create long-term financial and legal consequences. This paper’s purpose is to take a close look at the meaning of ethics, analyze the trends that contribute to unethical behavior, and we will define corporate social responsibility’s role. Then, we will look at the measures used to improve ethical conduct, and layout a structured framework for making ethical decisions.

What Are Ethics?

Ethics is a term which refers to principles, standards, and values that pilot individuals and organizations in deciding what stands right or wrong. Also, Ethics are rooted in moral philosophy and directly tied with concepts such as justice, fairness, responsibility, and honesty (Singer, 2025). In the business context, ethics shapes how organizations interact with stakeholders, make decisions, and conduct operations. Ethical behavior is not only about following laws but also involves acting with respect for others and with integrity. This is how this works, even when explicit rules do not exist. Ethics works as a moral compass to help individuals to navigate situations where competing interests or enigmatic circumstances may arise.

Trends Showing a Rise in Probability of Unethical Behavior

Multiple modern trends are heighten a risk of unethical conduct in businesse practices and organization practicess. Some issues may be apparent almost immediately, and some found through taking a deeper look to see why they happen and how they cause unethical behavior.

• Globalization
  • Operating across multiple countries introduces cultural differences. This can be considered by inconsistent regulations, varying enforcement standards, or even different value systems. These inconsistencies can create ethical gray areas, tempt organizations to exploit weaker regulatory environments or cause the organization to have trouble adjusting to the unfamiliar environment (Stefanovska Ph. D & Tanushevski Ph. D, 2016).
• Technological Advancement
  • Technology has increased the ability to access data, automation, and surveillance. This is beneficial, but it creates opportunities for privacy violations, misuse of data, even unethical data manipulation.
• Competitive Pressure
  • Organizations sometimes face immense pressure to meet financial targets, outperform competitors, and satisfy shareholders. Facing this pressure can encourage businesses and employees to cut corners, falsify results, or even ignore ethical considerations to achieve short-term gains (Caughron et al., 2013).
• Remote Work and Digital Communication
  • Remote work has provided jobs for people who need to work out of the office for one reason or another. This rise has reduced direct oversight of employees and increased the amount of dependence on digital communications. This total environmental shift to remote work allows one to hide unethical behavior.

How Corporate Social Responsibility Strengthens Business Ethics

The term corporate social responsibility, CSR for short, invokes the commitment of an organization to operate in ways that enhance society and the environment to focus solely on profit margins. CSR girdles elements like ethical labor practices, or community engagement, even sustainability initiatives (Reynolds, 2018). Stimulating good business ethics is critical, where character and trust are a small example of what is involved. Ethical organizations will build trust with customers, employees, and partners. A well-built ethical reputation can be a competitive advantage. Ensuring legal and regulatory compliance is a strong ethical behavior that reduces the risk of getting a violation of lawsuit against you or the organization you are representing. Keeping your focus on ethical business ethics will often raise employee morale and retain those employees. Employees tend to be more engaged and loyal when they believe their organization acts with integrity (Erickson, 2025). Another strong point is that companies will maintain stronger relationships with their stakeholders, communities, and regulatory boards when remaining ethical in practice. Ethics and corporate social responsibility are embedded together; corporate social responsibility reflects the organization’s ethical commitment to society while ethical behavior assures that corporate social responsibility initiatives are not performative, they are genuine.

Actions That Organizations Should Practice Cultivating Business Ethics

Something like we would do to strengthen our personal ethics, organizations can strengthen ethical behavior. It is good practice for an employee to be trained on what is considered unethical behavior so they can point it out and report it or at least, address it.

• Establish a Clear Code of Ethics
  • By outlining expected behaviors, values, and standards with a written code of ethics, you are providing employees with guidance to meet standards for proper organizational ethics (Parismita, 2022).
• Leadership Commitment; “Lead by Example”
  • Cultural practices begin at the upper levels or at higher seniority, and trickle down to others, good or bad. Leadership must model ethical behavior, communicate expectations, and hold themselves accountable (Freeland, 2018).
• Ethics Training Programs
  • It is always critical to train employees, especially concerning ethical dilemmas, helping them to understand policies, and to develop decision-making skills.
• Accountability and Enforcement
  • Policies need to be enforced consistently, with violations resulting in fair and transparent consequences. This allows the employee to understand what will happen if they break policy.

Step-by-Step Walkthrough of a Framework for Ethical Decision-Making

There come times where we fall into situations that are ethically challenging, a decision-making, one thing we can do to assure we are making responsible and thoughtful decisions is institute an ethical framework. The following is a step-by-step model providing a practical approach:

• Step 1: Identify the Issue raising ethical questions.
  • Clearly define the dilemma and determine what values, principles, or stakeholders are involved.
• Step 2: Assemble the Facts, Laws, Policies, and Stakeholder Views.
  • Collect facts, legal requirements, organizational policies, and stakeholder perspectives while avoiding assumptions.
• Step 3: Converge Possible Issues and Their Potential Effects
  • Decipher how each decision can will affect all stakeholders from employees to customers, other stakeholders, communities, and the environment.
• Step 4: Evaluate Options Using Ethical Principles
  • Apply ethical theories of each view allowing us to evaluate outcomes.
    • Ask yourself.
      • Utilitarianism: “What option promotes the greatest good?”
      • Rights-Based Ethics: “Which action acknowledges the individual’s rights?”
      • Justice/Fairness: What option supports the equitability of everyone involved?
      • Virtue Ethics: Which decision or action would reflect my moral character (Menon, 2025)?
• Step 5: Make the Decision
  • Decide which option will align best with not only your ethical principles, but also the organizational values, and abiding consequences.
• Step 6: Decision Launch
  • Transmit your decision clearly to the team and take any necessary actions, making sure to carry your actions out responsibly.
• Step 7: Look at What Happened and Why?
  • After implementation, gather your information, and evaluate the results. Consider what happened, why, and how I can change it, and decide how similar situations should be, in the future, managed.

Conclusion

A foundational role in shaping organizational demeanor and guiding decision-making is where ethics plays. There are trends followed today that increase the amount of complexity and the frequency of ethical challenges. This means that organizations must prioritize ethical culture, corporate social responsibility, and structured decision-making frameworks. By doing this, the organizations not only protect their reputation and legal status. They also contribute positively to society and ensure long-term success. Ethical organizations are better equipped to navigate uncertainty, build trust, and create sustainable value that all stakeholders can see.

References

Caughron, J. J., Antes, A. L., Stenmark, C. K., Thiel, C. E., Wang, X., & Mumford, M. D. (2013). Competition and Sensemaking in Ethical Situations. Journal of Applied Social Psychology, 43(7), 1491–1507. https://doi.org/10.1111/jasp.12141

Erickson, S. (2025, December 28). The Connection Between Corporate Ethics and Employee… Indfix. https://www.indfix.com/article/the-connection-between-corporate-ethics-and-employee-retention

Freeland, G. (2018, July 16). Culture Change: It Starts At The Top. Forbes. https://www.forbes.com/sites/grantfreeland/2018/07/16/culture-change-it-starts-at-the-top/

Menon, P. (2025, July 11). Every business owner—. Linkedin.com. https://www.linkedin.com/pulse/simple-guide-ethical-decision-making-business-owners-premraj-menon-e2alc/

Parismita. (2022). Code of Ethics: How Relevant are They in Today’s Business Operations | Keka. Keka HR. https://www.keka.com/code-of-ethics

Reynolds, G. (2018). Ethics in Information Technology, 6th Edition. [[VitalSource Bookshelf version]]. Retrieved from vbk://9781337681742

Singer, P. (2025). Ethics. In Encyclopedia Britannica. https://www.britannica.com/topic/ethics-philosophy

Stefanovska Ph. D., L., & Tanushevski Ph. D., M. (2016). THE IMPACT OF GLOBALIZATION ON ORGANIZATIONAL CULTURE. Indian Journal of Commerce & Management Studies, VII(ISSN: 2249-0310 EISSN: 2229-5674). www.scholarshub.net. issn: 2249-0310 EISSN: 2229-5674

Kant: Duty, Universal Rules, Categorical Imperative

Kants powerful moral theory, which is known as deontology, argues that morality is grounded on duty and good will. For Kant, the only thing that is good without qualification is the intention to do right. Consequences do not actually determine morality – only the intention behind the action. An interesting mention of this in the appendix is where the love of money being evil is mentioned followed by, “he is not saying that good will must always have good consequences” (Reynolds, 2018).

Immanuel Kant’s central principle is the categorical imperative, which is also seen as central to deontology. Categorical Imperative requires that we act only on maxims that can be applied universally without contradiction, with maxim being a moral rule (Wikipedia Contributors, 2019). Before acting, we must ask:

“Could everyone, everywhere, follow the rule?”

If universalizing the rule causes a contradiction to surface, the action is immoral. Examples in the appendix show this. A maxim like to “lie when it benefits me” falls apart, because universal lying will irradicate the possibility of truth, or “borrow money without intention of paying it back” would become impossible, because lending would end (Reynolds, 2018).

Thomas Hobbes: Self-Interest, Survival, and the Social Contract

Hobbes starts at a very different point: human beings are fundamentally selfish. I truly understand this view as well. According to Hobbes, in the state of nature, a world without rules, life would be “solitary, poor, nasty, brutish, and short” (Munro, 2024). This is because everyone pursues their own interests and with resources being as limited as they are, conflict is inevitable.

Ethical behavior, for Hobbes, does not stem from universal moral rules. This ethical behavior comes from mutual agreements, also known as the social contact. People will make these agreements to protect themselves, sometimes giving up freedoms in exchange for security.

Which Approach Resonates With Me

I sincerely appreciate Kant’s clarity, but at the same time Hobbes’ framework resonates further with me with the ethical decisions I encounter in the IR and cybersecurity fields. In my current landscape, ethical choices often revolve around:

• protecting users
• maintaining trust
• preventing harm
• balancing individual freedom with collective security

The way that I see this, these concerns align closely with Hobbes’ idea that ethical behavior emerges from mutual obligations and the need for stability. At the same time, on a moral level I agree highly with Kant’s rigid rules when applying this approach outside of technology.

Conclusion

Kant and Hobbes both offer powerful but very different ethical systems. Kant focuses on universal moral duties grounded in rational consistency. Hobbes emphasizes mutual agreements grounded in human self-interest and the need for social stability. Both of these perspectives are very valuable, but Hobbes’ social-contract approach clearly aligns more with the many ethical decisions I face in information technology and cybersecurity. This is a scenario where protecting others and maintaining trust are essential.

References:

Reynolds, G.  (2018). Ethics in Information Technology, 6th Edition. [[VitalSource Bookshelf version]].  Retrieved from vbk://9781337681742

Munro, A. (2024). State of Nature. In Encyclopædia Britannica. https://www.britannica.com/topic/state-of-nature-political-theory

Wikipedia Contributors. (2019, March 2). Categorical imperative. Wikipedia; Wikimedia Foundation. https://en.wikipedia.org/wiki/Categorical_imperative

Your Organization’s Information

In today’s digital age, organizations of all sizes handle vast amounts of data that require stringent protection. Data breaches can be costly, both financially and reputationally, making it crucial to understand the vulnerabilities that exist throughout the data lifecycle.

What is the Data Lifecycle?

The data lifecycle is a model that outlines the different stages data goes through within an organization, from its creation to its eventual disposal. Understanding this lifecycle is fundamental to implementing effective security controls.

Stages of the Data Lifecycle:

1. Collect: This is where data is gathered from various sources, both internal and external.
2. Store: Data is stored in various systems, including databases, cloud storage, and physical devices.
3. Use: Data is accessed, processed, and analyzed for different purposes.
4. Archive: Data that is no longer actively used but needs to be retained is archived.
5. Destroy: Data is securely disposed of when it is no longer needed.

Data Governance: The Key to Data Protection

Data governance encompasses the policies and procedures that dictate how an organization manages its data. Effective data governance ensures data privacy, accuracy, availability, and security throughout its lifecycle.

Key Roles in Data Governance:

• Data Owner: The person responsible for deciding who can access, edit, use, or destroy data.
• Data Custodian: The person or entity responsible for the safe handling, transport, and storage of data.
• Data Steward: The person or group that maintains and implements data governance policies.

Protecting Data at Every Stage

Organizations should have comprehensive data governance policies that outline procedures for protecting data at each stage of its lifecycle. These policies should address access control, data encryption, data masking, and other security measures.

Legally Protected Information

Certain types of data require extra protection due to legal and regulatory requirements. These include:

• Personally Identifiable Information (PII): Information that can be used to identify an individual, such as name, address, and social security number.
• Protected Health Information (PHI): Information related to an individual’s health, regulated by HIPAA in the U.S. and GDPR in the EU.
• Sensitive Personally Identifiable Information (SPII): Highly sensitive PII that requires strict access controls, such as bank account numbers and login credentials.

Key Takeaways

• Protecting data is crucial for maintaining privacy and security.
• Data governance policies provide a framework for managing data throughout its lifecycle.
• Data custodians play a vital role in ensuring data security.
• Understanding the different types of sensitive data and their legal protections is essential.

By implementing robust data governance policies and security controls, organizations can effectively protect their data and mitigate the risk of breaches.