A school-district policy governs authorized social-engineering drills. Which boundary best reflects ethical civic/education constraints?
Select an answer to reveal the explanation.
Short Explanation
Kids are off-limits, and demeaning cultural digs are not 'clever metrics.' School drills harden adults' habits without punching down. Shame posters and guardian impersonation theater fail the ethics sniff test.
Full Explanation
School-district policy for authorized social-engineering drills should ban SE tests that target minors or use culturally demeaning pretexts. Minors are not appropriate targets for civic/education SE measurement, and demeaning cultural pretexts inflict harm unrelated to security learning. Ethical drills harden adult staff habits—teachers, clerks, administrators—without punching down or exploiting protected populations.
Preferring culturally demeaning pretexts because they raise click rates optimizes a vanity metric while violating ethics and likely district policy. Allowing testers to impersonate students' guardians without ethics review risks trauma, privacy issues, and community trust damage far beyond any awareness benefit. Publishing failing teachers' names alongside deepfake clips as a deterrent is humiliation and potentially unlawful or policy-violating disclosure, not defense improvement.
Exam caveat: education-sector SE constraints are stricter than generic enterprise phishing. Expect bright lines around minors, demeaning content, and public shaming.
Operational check: encode bans on minor targeting and demeaning pretexts in district SE policy; route scripts through ethics/HR review; measure adult staff reporting; never publish individual failure content or deepfake shame materials.