Random Cybersafety checks for schools

questionable material, breaches identified

.A scheme of random audits to be performed on school computers will not only identify any questionable material downloaded by staff and students; it is also intended to finger any security breaches or vulnerabilities, says Claire Balfour of the Internet Safety Group.

The audits, planned as a long-term measure and entrusted to forensics company eCrime, will be one objective method for the Ministry of Education and Internet Safety Group to tell whether messages about safe practices of all kinds online are getting through, she says. Other success measures might be more difficult.

The group and the Ministry jointly launched a set of training modules last week, aimed at backing up the guidelines already published by the group in consultation with the ministry, teachers and law enforcement agencies.

Just because a staffer is running computers at a school, or responsible for “cybersafety”, it cannot be assumed that s/he knows a lot about the intricacies of good computing practice, network security, or, in a case of suspicion, how to make computers safe for forensic examination, Balfour says. This is particularly so in smaller and rural schools, where a teacher may have been entrusted with the IT curriculum and cybersafety simply on the strength of having used computers a little more than other members of staff.

As an example of a basic security breach through lack of knowledge, she cites a school that was very careful to check all diskettes coming into and out of the computer room and mark approved diskettes with the school’s name. “Strange” data proved to have been introduced using a flash memory pendant, and the teacher responsible said: “Is that what those things do? A lot of the kids wear those round their necks all the time.”

Putting responsible staff and members of the Board of Trustees through the newly devised courses should fill those knowledge gaps, Balfour says.

Most schools however, have at least some staff who are more knowledgeable about ICT than most other sectors of society, says the lawyer for the programme, Rick Shera. Legal expertise has been retained to frame licensing terms for the course material.

There are seven training modules aimed at six classes of people: the board trustees, principals, the designates cybersafety manager, the ICT manager, library personnel and school guidance staff including counseelors, guidance teachers, youth workers social workers and “resource teachers in learning and behaviour”. They vary from a 90-minute workshop for trustees and principals to a full day of instruction. Formal work-books have been designed, and a set of approved organisations will be licensed to deliver the instruction.

Measuring progress with the more direct effects of cybersafety failure – misbehaving or harassed students - will be more difficult, Balfour acknowledges, because of the effect of greater awareness. “It’s like the figures being quoted on child abuse; no-one knows whether the incidence is actually increasing or whether it’s greater awareness causing a greater reporting rate. It will be like that for a while in this area.”