Child safety in cyberspace

Published in Smart Techie September 2011 issue (www.thesmarttechie.com).  

“Mom, all my friends are on facebook, why is it that only I cannot have a facebook[1] account?”  My 10 year old daughter was pleading her case in the Supreme Court.  I could already see from the expressions on face of the Judge, the case was beginning to tilt in prosecution’s favour without even giving a chance to the defendant.  But I was not going to give up this case so easily, I had my defence ready…

Would you leave your child alone in a busy marketplace or on a highway?  The child would be prone to all kinds of dangers in the physical world – accidents, kidnapping, molestation.. I am sure none of us would do this.   

Then why would you leave the child alone on the information superhighway? I have seen many of us do this, unknowingly. 

Internet has become a necessity in our lives so much so that the United Nations has declared Internet Access as a human right. Today the schools are networked, have their own website and the homework instructions too are published on the net. Students as young as 4^th Grade are expected to log in on to the school website on a daily basis.  Students are required to browse the net to collect information and pictures for their projects. There is no denying that Internet has become an integral part of our children’s lives.  But the fact is that children are at risk in cyberspace, if we do not take adequate precautions.

More and more children now have their own cell phones. Children are exposed to text messages, MMS (multi media messages) and can also access Internet, social networks on their phones.

Alice in the wonderland

Inappropriate Content

<><><><> <><><><> <><><><> <><><><> Children use Internet to search information and pictures for school projects.  You would be shocked to see the amount of inappropriate information, images and advertisements are displayed when they search for seemingly innocuous queries and images and click on the links displayed in search results. Spam messages (including the ones selling blue tablets, exotic names showing interest to know you better etc.) do not distinguish between children and adult mail boxes.

Sharing personal information and images

Children share a lot of personal information including the name, address, passwords, information about their family, photographs over email and social networks. This information could be potentially misused for identity theft or other cybercrimes.

Most cell phones now have cameras which can capture photographs and videos. Explicit images / videos can be shared easily over the MMS and through mobile internet.     

Children do not understand the legal implications of creating, storing and distributing explicit photos or videos of minors. If such material is circulated through phones or Internet, children could be exposed to risk of embarrassment, leading to psychological disorders and could impact their studies and social life.

Big bad Wolves waiting for Red Riding Hood

<><><><> <><><><> <><><><> <><><><> Contact with Strangers              

Children may come into contact with strangers on social networks, chat rooms, online forums or email. Strangers could take advantage of the impressionable minds and persuade them into parting with personal information, photographs, videos etc.  Such predators are known to entice children by promising gifts in return for sharing information. The online contact may advance to telephonic contact and finally meeting them in real life – without the knowledge of parents. 

Cyber stalking, Cyber bullying

Bullying is common in schools and on the playground. However, with the advent of technology in their lives, children have also adopted a new form of bullying – online and over cell phones.  The difference is that cyber bullying can occur anytime, anywhere – the child can receive offensive messages while at home over the Internet or SMS.  Derogatory messages or information against a child can be posted over social networks, forums or over chat.  

Predators ask children for their cell phone numbers after meeting them online since it allows them to contact the child anytime. They can stalk a child, could send abusive, threatening SMS or emails.    

How do we minimise these risks?

To ensure that your child is safe in cyber space, you need to establish ground rules, monitor use and discuss safety practices with children.  It is important that children trust you and share important information with you about their online activities regularly. Various technology controls are also available to prevent, monitor and detect any problems. 

Awareness and rules

Especially for pre-teens, try to supervise Internet usage personally as far as possible.  Set time limits for Internet use and keep the home computer in an open area like the living room.

Explain to children that they should never give out personal details to online friends. Make them understand what information about them is personal: i.e. home address and telephone numbers, user-ids/passwords, email address, mobile number etc. They should not share any pictures or videos of themselves, their family or friends – except under your supervision.

If your child receives email from unknown persons, spam or junk mails, remind them never to believe their contents, reply to them or click on any links. They should not open files that are from people they don't know - it could be a virus or an inappropriate photo or video.

Explain the consequences of posting or forwarding inappropriate material online or through cell phones.  It could harm the child’s reputation and his life.

Just as in real life we warn them about interacting with strangers, the same rule applies in cyberspace.  They should not talk to strangers in chat forum, accept invites on social networks or respond to SMS or emails from strangers. 

It is important for children to know that that people may not be always speaking the truth online and they should not believe everything that they see or hear online. If an online friend asks them to meet, they should inform you, and you can arrange for a supervised meeting if appropriate.

As a responsible parent, be firm not to let your child get access to content that is not meant for their age, e.g. DO NOT let you child have his own facebook account if they are below the prescribed age limit. There are separate social networking sites especially for children.

Technology can help

Make sure your home computer has updated anti-virus software and there is no inappropriate content on it.

Children should use child friendly search engines.  Alternatively, make sure “safe-search” settings are enabled and locked down in the regular search engines. This can help keep out inappropriate content being displayed, while searching for information or images.   

If your children have unsupervised access, consider installing “parental control” software. This will help prevent access inappropriate content as well as help you monitor the online activity of children. If your child has a cell phone, consider getting an itemised statement which can help identify any specific / unknown numbers which are calling / messaging frequently and at odd hours.

 Magic wand

The magic wand is “TRUST”.  If your child trusts you, they will talk to you if they have had any problem in cyberspace – just as they would talk to you about any problem in school or on the playground. Children should know that it's never too late to tell if something makes them feel uncomfortable. So it is important for you to build the bridge of trust, which can keep the child safe from any evil spells! 

P.S.:  After hearing my defence, my Supreme Court ruled that we settle the matter out of court – so finally my daughter did get her account – but on a social network site specially created for children…

---

[1] As a policy Facebook allows individuals only above the age of 13 to create an account.

Security Metrics: Demonstrate the Business Value

Security Metrics: Demonstrate the Business Value

                               

"The top management doesn’t want to listen to a technology speech. Show them trends and measurably demonstrate the business value of the various controls put in place"

What does the management look at, in the money spent by the company’s information security specialists on various controls?
Our company, Bharti AXA General Insurance Company Ltd., is a general insurance joint venture started about three years ago, and right from the start, I’ve been interacting extensively with the business side of the company. We were late entrants into the insurance market, we were probably the 16th entrant, there were giants ahead of us, and shareholders wanted to get into the top five in the five-year time frame.
Every time I went to the management to get budget approvals for information security, the questions were very different from what I’d faced earlier. The management would say, ‘fine we’ll give you the money, but tell us how this will help us get into the top 5 slot in the insurance market?’ I would get stumped, thinking I’m talking about security and controls, but the management needs to know how that will help the company meet its objective.
Balanced Score Card: Such questions prompted us to attempt a balanced-score-card approach to demonstrate the value at risk, to our business colleagues. Our company’s mission is to become the preferred general insurance provider for our customers, partners, employees, and, shareholders. The balanced score card talks about finance, employees, learning and growth and customers, which put our mission statement in alignment with the score card quadrants. That’s how we got the idea to use the score card approach to show how information security is adding value and contributing to the company’s growth.
Every department had to come up with their goal sheets in line with the mission statement. The Information Security team also did the same. While not exactly following the score card methodology, we looked at how we can add value to shareholders, partners, and customers.
Metrics: What did we measure? Instead of the normal way of counting incidents, user IDs created or deleted, we tried to give them a business value number on what is at risk. How does one match the security metrics with the top line and the bottom line with every single security incident -- we presented this from a finance and business perspective.
For example, if the company’s website went down for a certain period, customers won’t be able to buy online policies, which would hit the top line. While this isn’t a fool-proof system, and has a lot of assumptions, it still yields a way to value risk to business. Therefore, tracking the number of customers who generated quotes using the site would be an indicator, as the ratio of the quotes generated to actual conversions to policies sold is known.
If we don’t have Log monitoring, firewalls, IPS, IDS and so on, what would be the value at risk. From a regulatory and compliance point of view, the auditors from the Insurance Regulatory Authority of India tend to look at the steps we’ve taken from the perspective of customer protection, which again plays into the idea of figuring out what’s the value at risk and how the score card will be affected by the absence of certain IS measures.
Business executives look for trends in the form ‘where were we six months ago and what is our position today and where do we want to be two quarters down the line.’ Finding a way to show in a measurable way, which way the risk to the business is moving before and after putting in place various controls, will help CIOs get the backing of their business colleagues.

Dear CIOs, CTO Forum is happy to present this opinion piece by Parag Deodhar, Chief Risk Officer, Bharti AXA General Insurance Company Ltd., in continuing our efforts to bring you expert opinion of substance from peers and specialists. The top management doesn’t want to listen to a technology speech. Show them trends and measurably demonstrate the business value of the various controls put in place Click here for the full opinion. We value your feedback:editor@thectoforum.com. Happy reading, Team CTO Forum 9.9 Media | B - 118, Sector 2 | Noida - 201 301 | I N D I A

Bring out the value at risk in both the top line and bottom line, and your information security plans will get the business backing, says Parag Deodhar, CRO of Bharti AXA General Insurance Company. Click herefor the full opinion.