Describe to students that as a future information security professional, they must understand the scope of an organization’s legal and ethical responsibilities.
Disseminate that the laws and ethics are not the same thing, as laws carry the authority and ethics do not.
Describe ethics, which are based on cultural mores and express the fixed moral attitudes or customs of a particular group. Some ethics are recognized as universal among cultures.
Explain how to minimize liabilities and reduce risks from electronic and physical threats, and to reduce all losses from legal action, the information security practitioner must understand the current legal environment, stay current with new laws and regulations, and watch for new issues as they emerge.