ethical practices for cybersecurity investments purchases