Legal, Ethical, and Human Aspects of Cybersecurity

Course Description

Legal, Ethical, and Human Aspects of Cybersecurity addresses the human facets of cybersecurity. UWF states that coverage will include ethics, legal and regulatory environment, psychology, and hacker culture, and that the focus will be on the human element and the motivation and deterrence of cyber-crimes.

Within the SCNS taxonomy, ISM is the Information Systems Management prefix. The University of West Florida publishes this at 3 semester hours through the Department of Business Administration, College of Business. It is offered at approximately 6 Florida institutions.

⚠⚠ The statewide inventory title for this number is "Applications in Information Security," which suggests a technical applications course. UWF's course is the opposite — explicitly the human, legal and ethical side. This is the most significant title divergence in the prefix. If a programme or an employer expects "applications in information security" to mean hands-on tooling, this course will not deliver that, and the guide says so rather than papering over it. See the note below.

The subject is more consequential than its soft-sounding title suggests. The overwhelming majority of successful attacks begin with a person — a clicked link, a reused password, an unverified phone call, a helpful employee. Understanding why people behave that way is not a supplement to technical security; it is where most of the actual risk lives.

⚠ The legal material is genuinely important and genuinely difficult, because computer crime law is fragmented across federal statute, fifty states, and international boundaries that attackers ignore. Florida has its own breach notification law with a 30-day notification requirement, and it applies to organisations that hold Floridians' data regardless of where they are based.

On "hacker culture": UWF names it, and it belongs in the course. Understanding motivation — curiosity, ideology, status, grievance, money, state direction — is what makes deterrence and defence design rational rather than reflexive. This is a course about understanding adversaries, not about becoming one, and the ethical and legal boundaries are part of the content.

⚠ The contact-hour figure is derived — the University of West Florida publishes none

UWF's catalog publishes a credit value in semester hours, the college and department, and prerequisites. It does not publish contact hours, a lecture and laboratory split, or terms of offering for any course. Every contact-hour value in a UWF guide in this repository is derived. The figure applies the standard lecture convention of 15 contact hours per credit, giving 45 hours for 3 semester hours. ⚠ Note that ISM courses are project-heavy, and scheduled contact hours understate the real time commitment considerably — budget for project work outside class. Confirm the meeting schedule and delivery mode with the department.

Learning Outcomes

Required Outcomes

• Describe the human element in cybersecurity incidents and its scale.
• Describe social engineering techniques and the psychology behind them.
• Describe cognitive biases and heuristics exploited by attackers.
• Describe why security awareness training succeeds and fails.
• Describe usable security and the cost of security friction.
• Describe insider threat, both malicious and negligent.
• Describe threat actor categories and their differing motivations.
• Describe hacker culture, its history, and its internal norms.
• Describe the ethical frameworks applicable to security practice.
• Apply a professional code of ethics to a security dilemma.
• Describe responsible and coordinated vulnerability disclosure.
• Describe major United States computer crime statutes including the CFAA.
• Describe the legal boundaries of authorised security testing.
• Describe privacy law and its application to organisational data.
• Describe Florida breach notification requirements and their timelines.
• Describe sector regulation including HIPAA, GLBA, FERPA, and PCI-DSS.
• Describe international and cross-border enforcement difficulties.
• Describe digital evidence handling and chain of custody in outline.
• Describe deterrence theory as applied to cyber-crime.
• Evaluate the effectiveness of legal and organisational deterrents.
• Analyse an incident from human, legal, and ethical perspectives.

Optional Outcomes

• Apply the material to a real organisation or a case study.
• Use AI-assisted tools appropriately and verify their output.
• Communicate technical findings to a non-technical audience.
• Work effectively in a project team with defined roles.
• Build a portfolio artefact suitable for showing an employer.

Major Topics

Required Topics

• The human element in incidents
• Social engineering and its psychology
• Cognitive bias and exploitation
• Security awareness training and its limits
• Usable security and friction
• Insider threat
• Threat actors and motivation
• Hacker culture and history
• Ethical frameworks in security
• Professional codes of ethics
• Responsible vulnerability disclosure
• Computer crime statutes and the CFAA
• Boundaries of authorised testing
• Privacy law
• Florida breach notification
• HIPAA, GLBA, FERPA, PCI-DSS
• Cross-border enforcement
• Digital evidence and chain of custody
• Deterrence theory
• Evaluating deterrents
• Multi-perspective incident analysis

Optional Topics

• Applied case studies and live organisations
• AI-assisted tooling and its verification
• Communicating findings to non-technical stakeholders
• Team project practice
• Portfolio development

Resources & Tools

• The text the instructor assigns — Whitman and Mattord cover the legal and ethical material substantially; Hadnagy's Social Engineering is the standard on technique and psychology.
• Florida Statutes §501.171, the Florida Information Protection Act — free; read the actual statute. It is short, it is readable, and it governs breach notification for anyone holding Floridians' data.
• The Computer Fraud and Abuse Act and DOJ charging policy — free; ⚠ the boundary between research and crime is narrower and less obvious than students assume, and this is the material that defines it.
• Verizon DBIR — free, annual; the human-factor share of breaches, with evidence rather than assertion.
• (ISC)² and ISACA codes of ethics — free; short, enforceable, and the right material for working through dilemmas.
• CISA and FTC guidance on privacy and breach response — free; what organisations are actually told to do.
• The UWF library's business databases — included in enrolment; practitioner sources such as Gartner and industry reports are behind paywalls a student already has, and most never find out.
• LinkedIn Learning — frequently free through UWF or a Florida public library card; strong on specific tools, weak on judgement. Use it for the software, not the thinking.

Career Pathways

• Business or systems analyst (SOC 15-1211, computer systems analyst) — the most common destination for this major, and the role this prefix is most directly built for: translating business needs into system requirements.
• Data analyst and business intelligence analyst (SOC 15-2051, data scientist; SOC 13-1111, management analyst) — the fastest-growing destination, and the reason the analytics courses in this prefix matter.
• Information security analyst (SOC 15-1212) — strong demand and strong pay in Florida, particularly around defence contracting in the Panhandle and Space Coast. Note that this prefix teaches security management, not penetration testing — a real and separate career.
• Database administrator and data engineer (SOC 15-1242, 15-1243).
• IT project manager — commonly entered after several years as an analyst; PMP or CAPM certification is the usual credential.
• ERP functional consultant — SAP, Oracle, Workday, Microsoft Dynamics; a well-paid path that is under-advertised to undergraduates.
• ⚠ Florida employer landscape: defence and aerospace contractors (Lockheed Martin, Northrop Grumman, L3Harris, and the Navy presence around Pensacola), healthcare systems (AdventHealth, Orlando Health, BayCare, Baptist, Ascension Sacred Heart), hospitality and theme parks (Disney, Universal, the cruise lines out of Miami, Port Canaveral and Tampa — all of which run substantial IT organisations), financial services (Raymond James in St. Petersburg, Fidelity in Jacksonville), logistics, and state and county government.
• ⚠ Security clearance is a genuine career asset in this state. Northwest Florida's defence concentration means clearable candidates have access to roles others do not — worth knowing early, because the process is slow and starts with an employer sponsoring you.

AI Integration

Information systems is one of the fields where generative AI has changed working practice fastest, and pretending otherwise would not serve a student. The honest position is that these tools are genuinely useful, genuinely unreliable, and that the professional remains accountable for the output regardless of what produced it.

• Where AI tools help in this domain: drafting and explaining code and SQL, generating test data, summarising documentation and standards, producing first-draft requirements and process descriptions, writing spreadsheet and BI formulas, and explaining an unfamiliar error message — which is a large share of what stalls a beginner.
• ⚠ Where they fail, specifically: they invent plausible functions, libraries, and API endpoints that do not exist; they produce code that runs and is subtly wrong; they are confidently wrong about anything niche, recent, or organisation-specific; and they cannot know your data, your business rules, or your regulatory constraints unless you tell them.
• ⚠⚠ The failure mode that matters most here is a wrong answer that looks right. A query that returns rows is not a query that returns correct rows. Verify against known values before you trust an analysis, and be especially careful with joins, filters, date handling, and anything involving aggregation.
• ⚠⚠⚠ Never paste confidential, personal, or regulated data into a public AI tool. Organisational data, customer records, health information, and anything under FERPA, HIPAA, GLBA or PCI-DSS must not leave a controlled environment. This is a genuine and common way that early-career employees cause serious incidents, and "I did not know" is not a defence that helps anyone. Use synthetic or anonymised data for anything you take outside a sanctioned system.
• Academic integrity: the course policy governs, and policies differ. Some instructors encourage AI use with disclosure, some restrict it to specified tasks, some prohibit it. Read the syllabus and ask if it is unclear — assuming is how students end up in an integrity process.
• ⚠ The professional argument for learning without it first is real, not moralising. If you cannot read and evaluate the output, you cannot catch it when it is wrong — and an employer is paying for the judgement, not the typing. Use AI to go faster on things you understand; do the learning yourself.
• Cite and disclose what you used, when the policy asks. This is becoming a normal professional expectation as well as an academic one.

Special Information

⚠⚠ ISM3011 is the gateway to the entire prefix

• Every undergraduate ISM course at UWF except ISM3011 itself requires it. ISM3116, ISM3323, ISM4113, ISM4320, ISM4321, ISM4400, ISM4481 and ISM4483 all name it. Nothing else in the prefix opens without it.
• ⚠ That makes it a single point of failure in your schedule. Delaying or failing ISM3011 delays everything downstream, and there is no alternative route around it. Take it as early as you are eligible.
• Only ISM3323 offers an alternative — it accepts ISM 3011 OR COP 2253, a programming route. It is the sole exception in the prefix.
• ⚠ ISM3011 itself has an unusual prerequisite: not a course, but completion of 45 hours of college coursework. See the note on standing requirements below.

⚠⚠ The statewide title and the UWF title differ — read the description, not the name

• Statewide inventory title: Applications in Information Security. UWF publishes it as: Legal, Ethical, and Human Aspects of Cybersecurity.
• ⚠⚠ This is the largest title divergence in the prefix and it may be a genuine difference of subject rather than of wording. "Applications in Information Security" implies applied technical work; UWF's course is explicitly the human, legal and ethical dimension and states that its focus is the human element. A student needing an applied technical security course should not assume this satisfies it, and a programme requirement written against the statewide title should be checked against this description before you register.
• ⚠ The practical advice is the same in every case of title drift: carry a syllabus. A transfer evaluator matching on the number will accept it; one matching on the title may query it, and one comparing content may reach a different conclusion again.
• Search on the number, not the name, when looking for equivalents at other institutions. SCNS equivalency runs on the number and the content.

⚠⚠ UWF runs a cybersecurity sequence inside a BUSINESS prefix — know what that means

• Three ISM courses form a security sequence: ISM3323 Information Security Management, ISM4320 Legal, Ethical, and Human Aspects of Cybersecurity, and ISM4321 Cybersecurity Risk Management. All three sit in the Department of Business Administration, College of Business.
• ⚠⚠ This is security management, not security engineering. The sequence teaches governance, risk, policy, law, human factors and incident planning. It does not teach penetration testing, exploit development, malware analysis, or network defence operations — those are computer science and IT courses, and at UWF they live under different prefixes.
• Neither half is the "real" one. Organisations are breached through unpatched systems and through untrained people in roughly equal measure, and the majority of security work in a large organisation is governance, audit and risk rather than hands-on-keyboard. But a student who wants the technical career needs the technical courses, and this sequence will not supply them.
• ⚠ The strongest position is both. A graduate who can read a risk register and a packet capture is unusually valuable, and the combination is what security leadership roles actually require.
• Practical step: check whether UWF's computer science or IT programmes will let you take networking and security technical electives alongside this sequence, and ask early — prerequisite chains in those prefixes are long.

⚠⚠⚠ The legal boundary is not a formality — know where it is

• Studying attacks is lawful. Performing them on systems you do not own or have written permission to test is not. The Computer Fraud and Abuse Act turns on authorisation, and authorisation means explicit, documented, and from someone with the authority to grant it.
• ⚠⚠ "I was only looking" and "the system was insecure" are not defences. Students have been prosecuted, expelled, and rendered unemployable in this field for curiosity exercised on the wrong system — including their own institution's.
• ⚠ Never test against university systems. Use a lab environment, a personal machine, or a sanctioned platform such as a capture-the-flag range. If you find a vulnerability accidentally, report it — do not explore it further, because further exploration is exactly what converts a good deed into an offence.
• Responsible disclosure has a normal shape: report privately, allow reasonable time to fix, coordinate publication. Many organisations run bug bounty or disclosure programmes that give you written authorisation in advance — that is the lawful way to practise.
• This matters for your career, not only your record. Security employment frequently requires background investigation, and a conviction or an institutional finding closes doors permanently in a field that otherwise wants you.

⚠ Northwest Florida is a defence region, and that shapes this career

• Pensacola and the surrounding area carry a substantial military and defence-contracting presence — NAS Pensacola, NAS Whiting Field, Eglin and Hurlburt Field, and the contractors that serve them. Cybersecurity demand there is real and sustained.
• ⚠⚠ Many of those roles require a security clearance, which you cannot obtain on your own — an employer must sponsor it, and the process takes months. Knowing this early changes how you approach internships, because a sponsored internship is the usual on-ramp.
• Clearance eligibility is affected by things students do not expect: significant debt, foreign contacts, and drug use including cannabis, which remains federally prohibited regardless of state law. This is stated as fact, not as advice about how to live.
• DoD 8140 (formerly 8570) specifies baseline certifications for defence cybersecurity roles — CompTIA Security+ is the common entry requirement. Having it before you graduate is a genuine advantage in this region.
• Florida's other security demand centres: healthcare systems (HIPAA-driven), financial services in Tampa Bay and Jacksonville, the cruise lines, and state and county government.

Certifications worth knowing about

• ⚠ A degree and a certification do different jobs. The degree is the durable credential; certifications are current, specific, and expire. Employers in this field ask for both, and neither substitutes for the other.
• Analytics and data: Microsoft Power BI Data Analyst (PL-300), Tableau Desktop Specialist, Google Data Analytics, AWS and Azure data certifications. Several have free or heavily discounted student pricing — ask the College of Business.
• Security: CompTIA Security+ is the standard entry credential and is frequently a hard requirement for defence-adjacent work under DoD 8570/8140; CISSP and CISM are management-level and require documented experience.
• Project and process: CAPM, PMP, and the Scrum credentials.
• ⚠ Do not collect certifications instead of building things. A portfolio of real projects — a dashboard, a database, an analysis with a written recommendation — outperforms a list of badges in almost every hiring conversation in this field.

Transfer, articulation, and how Florida course levels work

In the Florida Statewide Course Numbering System the first digit is the level: 1 and 2 are lower division, 3 and 4 upper division, 5 and above graduate. ⚠ A lower-division course generally cannot satisfy an upper-division requirement, which matters in this prefix — ISM2000 and ISM3011 both introduce information systems, and only the second is upper division.

⚠⚠ Business programmes add a layer that SCNS does not. Many Florida business colleges are AACSB accredited, and AACSB programmes commonly limit how much upper-division business coursework may transfer in — frequently requiring a substantial share to be taken in residence. A course can articulate under SCNS and still not count toward the major. Check the receiving programme's residency rule before you rely on a transfer.

Many business programmes also impose an admission-to-the-major step with its own grade point requirement, and a minimum grade in each core course. Confirm both against your own catalog year.

Course format and position in the curriculum

• Lecture with substantial project and applied work. ⚠ ISM courses are consistently more time-consuming than their credit value suggests, because software work expands to fill the debugging available.
• ⚠ No "permission is required" marking appears anywhere in the ISM prefix, and no fee notices — enrolment is gated by ISM3011 and by standing.
• Ask about delivery mode. UWF offers substantial online provision in the College of Business, and an online section of a project-based course demands more self-management, not less.
• UWF publishes no contact hours or terms of offering. A course offered in one term only will delay a sequence by a full year if missed — confirm with the department.

ISM4320 is 3 semester hours at the University of West Florida.