Ethics
Ethics was a ten-week general education course, and it was not a technology course. It still turned out to be one of the more useful classes for the way I think about my work in security and vulnerability management. Each unit introduced a moral framework, then asked me to apply it to a real situation and defend the conclusion. The point was less about memorizing definitions and more about reasoning clearly when values, not just facts, are on the line.
What the course covered
The early units built the vocabulary: the difference between a descriptive claim about what people do and a normative claim about what they should do, and why an ethical argument rests on a value claim rather than facts alone. From there each week added a lens. Divine command theory, then W. D. Ross and his prima facie duties, then utilitarianism weighed against Kantian duty, then Aristotle's virtue theory and practical wisdom, then the ethics of care and its relationship to justice, then natural law and the idea that a role has a purpose, or telos.
The back half applied those lenses to harder cases. A unit on punishment and the death penalty looked at a state that exempted its execution protocol from normal administrative review. I argued from justice rather than desert: the prisoners were not asking to escape the sentence, they were asking that the rules governing it stay challengeable, and that is a minimum condition of legitimate authority. A unit on workplace harassment compared prevention-based laws in South Africa, India, and Australia against the remedial model in the United States. I took a Kantian position, that a system requiring employers to prevent harm respects dignity more fully than one that compensates after the fact. The course closed on environmental and animal ethics, weighing anthropocentric, biocentric, and ecocentric views against real cases like endangered species protection and industrial pollution that went undisclosed.
Takeaway
Two ideas stuck. The first was telos. If the purpose of my role is protecting systems and the people who depend on them, then cutting a security corner or misusing privileged access contradicts the work itself, whether or not anyone would ever notice. The second came from the harassment unit, and it maps straight onto security: prevention is a different moral posture than remediation. Patching before exploitation and cleaning up after a breach are not two versions of the same duty.
Underneath both is the gap between facts and values. A scanner tells me a vulnerability is real, but no finding by itself tells me I ought to report it or how to weigh it against speed and convenience. That step needs a framework. This course gave me several, and the practice of choosing one on purpose is the part I expect to keep.