Legal and Ethical Practices in Information Security