TEACH YOUR CHILDREN WELL - ICT SECURITY AND THE YOUNGER GENERATION

David Harley
NHS Connecting for Health/Independent Author & Researcher

Eddy Willems
NOXS and EICAR

Judith Harley
Bohunt Community School, Liphook, Hampshire UK

ABSTRACT

An article by Eddy Willems in the August 2004 edition of VB discussed his research into the security awareness of Belgian children. The authors have developed this theme by submitting a similar questionnaire to ICT pupils in the UK and using the results as a basis for an interactive presentation and discussion with several groups in the UK, and an assignment-based follow-up with different groups was undertaken early in March 2005. 

The paper is not intended as a completed formal study, but considers this presentation and the issues that came up in this preliminary research as a basis for further study and teaching tools. It also considers a range of resources in the area of child safety, learning, attitudes and behaviour as they affect and are affected by the use of information and communications technology, and the influence of the media, government, and the Internet itself. While the preliminary research has largely focused on malware and email abuse, we will also consider how these areas are connected with other technologies and areas of concern among parents and educators. 

INTRODUCTION

“Teach your children well, 
Their father's hell did slowly go by…”
{Graham Nash, for Crosby, Stills, Nash and Young)

In August 2004, Virus Bulletin published an opinion piece by Eddy Willems [1] based on some informal research in Belgian schools. On one hand, he talked to MEGA officers and school teachers about the levels of computer awareness they found in the children they meet (MEGA officers give lessons to 12-year-olds designed to raise awareness of the problems associated with drugs, alcohol, violence and so on). He also talked to a small group of children about the following group of questions. (Note that this was a live discussion rather than the administration of a formal survey.)

INITIAL QUESTIONNAIRE

•	Do you know what a virus is?
•	Have you ever been affected by a virus?
•	What are the effects of a virus?
•	Do you click on every link in an email and open every attachment you receive?
•	Do you use an easy password?
•	How can you surf on the Internet safely?
•	What do you think of virus writing or hacking?

SUMMARY OF BELGIAN RESPONSES

Do you know what a virus is?
•	No
•	It eats your emails
•	It wipes out everything
•	The computer is sick

Have you ever been affected by a virus?
•	20% said “Yes”
•	10% said “No”
•	70% said “I don’t know”

What are the effects of a virus?
•	See answer 1. However, it became clear that none of the children really seemed to know what viruses do – none of them mentioned self-replication.

Do you click on every link in an email and open every attachment you receive?
•	99% said “Yes”

Do you use an easy password, such as your first name, birthdate etc.?
•	80% use a blank password if possible
•	16% use an easy password
•	4% use a difficult password

How can you surf on the Internet safely?
•	“I surf to kids’ sites” [laughing]
•	“Isn’t the Internet safe?!”
•	“I use Google”

What do you think of virus writing or hacking?
•	“Cool”
•	“Dangerous for your health”
•	“Oh my father does it all the time…”

CONCLUSIONS AND OPINIONS

Eddy’s article concluded that the children participating 
•	had little idea about computer security
•	some found the idea of hacking or virus writing attractive, and knew how to bypass parental controls
•	had little knowledge generally about ethical computer behaviour and netiquette. 

It was further hypothesised that policy and law makers are not fully aware of the societal structure of cyberspace and may fail to create an appropriate ethical model, or develop realistic policies and effective law, and that there is a need for ethical computer education at a much earlier age.

THE UK QUESTIONNAIRE

Judith Harley, who teaches ICT at a secondary school in Hampshire, UK, asked several groups of children there to fill in the same questionnaire. While some of the questions were really a little too open for written responses, this did prove a useful way of introducing the subject of security at an appropriate stage of the curriculum. Since it was done just before David Harley visited the school to talk to some Year 11 groups (15-16-year-olds) about security, ICT, and the “dark side of the internet”, it proved both a useful jumping-off point for discussion and an interesting comparison with Eddy’s findings. 

Summary of UK Responses

We must here reiterate that none of the exercises here constitute rigorous statistical research: the groups in both cases were fairly small and very localized, and the UK group was significantly older. Answers were freeform, so elements of response to one question sometimes seeped into responses to other questions, and responses often included more than one disparate element, making strict quantification impractical. Nor was it practical to take copying and consultation into account. Some seem to have been looking for “the right answer” where there was no single correct answer. The real value of the exercise lay in:
1.	The group discussions that followed
2.	A snapshot of security awareness among small but disparate groups of young people
3.	Laying a basis for further research.

Do you know what a virus is?
•	Nearly all said yes, but most didn’t expand on that in their written response. 
•	Three said “programming code”
•	One said “software used to hack into (crossed out kill) your PCs”.
•	Two mentioned infection without defining what they meant by infection.
•	Two mentioned and defined replication, and one of them used the phrase “parasite program” in addition to an approximation to a “classic” Cohen-esque definition (“A computer program that can reproduce by changing other programs to include a copy of itself”).
•	One said “A program attachment.”
•	Several offered a definition based on effect:
o	“It changes your files and desktop…”
o	“Something that breaks the computer e.g. Trojan, worm or virus”
•	Two offered definition by example (Trojan horse, worm, Code Red).

Have you ever been affected by a virus?
•	About half said no.
•	About half said yes.
•	One said no, having crossed out yes.
•	Two said yes, frequently, one said yes, once.
•	One said “Yes, off a file-sharing program (limewire)”.
•	One said “No – I have anti-virus security software.”
•	One said “Yes, but sometimes you can’t tell if you have them.”
•	One null response.

What are the effects of a virus? [Probably 2nd most subjective range of answers]
•	Crashing programs [2] Destroy programs [1]
•	Slow performance of PCs, jam system [several]
•	Data corruption [6]
•	File corruption [5]
•	File deletion, delete work [5]
•	Folder deletion [2]
•	Screw up PC [9]
•	Kills computer [3]
•	Doesn’t do anything [2]
•	Takes control of your computer [2]
•	“Can be different for each virus. Some can destroy software and some don’t do anything.” “Maybe harmless messages, maybe data corruption or destruction.” “Depends on the virus.” “Virtually anything.” “Various” [2] 
•	Don’t know. [1]
•	Changes your boot sector…deletes files…allow remote control of your PC
•	Spread quickly.
•	Eat up your hard drive.

Do you click on every link in an email and open every attachment you receive?
•	Most said no [one said because of viruses]
•	Yes [3]
•	Yes, but scan first [2]
•	Yes, if they look important [1]
•	Yes, because I want to look to see what it is.
•	“Only if it’s someone I know.” “Depends on the sender.”
•	“Download file.” [This may mean that they expect it to be scanned on download. This may derive from a mail server set to warn the user to save rather than open the attachment. YMMV on the usefulness of this approach.]

Do you use an easy password?
•	Two said yes.
•	Rest said no: one said “Complicated: contains numbers and letters”; four said “No, otherwise easily discovered.”

How can you surf on the Internet safely?
•	Go only on sites you know you can trust [5]
•	Use Google “Safesearch” option
•	About 50% said “Use anti-virus software”. Some named specific AV, usually Symantec/Norton (must be nice to have all that market share!). Almost as many mentioned firewalls, and one specifically mentioned ZoneAlarm.
•	One said “Internet Security”.
•	One said “Never click on pop-ups”. One said use a pop-up blocker.
•	Three mentioned anti-adware and/or spyware filtering.
•	“I don’t know. My AV and firewall doesn’t seem to have any effect.”
•	One null response.
•	“Don’t click on suspicious links.”
•	Don’t give personal details to strangers [2]
•	Common sense. [1]
•	Security software [1]
•	Going through search engines.

What do you think of virus writing or hacking? [Most subjective range of answers]
•	Done by nerds who have nothing better to do
•	Pain in the backside [2]
•	Wrong/bad/disagree with it. [about a third]
•	Annoying. These writers [sic] should all die and burn in hell.
•	Hackers should be stoned. Virus authors, hanged.
•	If I could, I would to those who annoy me.
•	Stupid/foolish/ridiculous/pointless [5]
•	Very clever/smart [2]
•	Clever but wrong [2]
•	Cool [2] Great  [1]
•	It’s bad and should not be sold (?)
•	Dan does it all the time.
•	Useless and time-wasting.
•	Not safe [1]
•	These bad, bad boys!!!
•	Should get tougher sentences and be more tightly controlled.
•	Shouldn’t write viruses because it can wreck people’s work and computers.
•	Sometimes it can be used for good but otherwise it’s wrong.
•	Virus writing or hacking is wrong when it is used for fun. Sometimes, though, it can be used to test a system’s security, leading to improvements in the long run.
•	Virus writing – bad. Hacking – if employed to check loopholes in the employer’s software, good. If used to delete items - bad

UK Follow-Up Assignment Questions

The next stage was to set several Year 10 groups an assignment involving some Internet research. It was hoped to coordinate this with another visit from David Harley to talk to the relevant groups, but this proved impossible at that time. 

Task – Internet Intrusion
•	Name at least three types of “viruses” and give an example of each type.
•	How do viruses get passed onto your computer?
•	Why would someone send a virus across the Internet?
•	What must individuals and firms always do to be prepared for the threat of viruses?
•	What does the term “social engineering” mean?
•	Name three types of web scams
Create a newsletter (using newspaper column layout to write about all of the above to be presented to new staff in a company. Give your newsletter an appropriate title and use headings and clipart.

Summary of Responses

The presentation of the responses as a newsletter is not considered here, of course. The significance of this work lies in what the pupils’ research actually suggested to them, and in how capable they were of assessing and interpreting the information received. Unfortunately, information on the resources found by these groups or the search criteria they used is not available.

Name at least three types of “viruses” and give an example of each type.

•	Macro viruses – nearly half mentioned these, and one described them as “probably the newest type of virus”. 
•	File Viruses – mentioned by about a quarter, though several seemed to assume in their responses to the next question that parasitic 
•	Boot Viruses -33% [But only one appeared to understand the mechanisms by which these infect, and mentioned them in response to the next question.]
•	Multipartite viruses – around 1/4
•	Polymorphic or mutation viruses – about 1/3: one gave a detailed and accurate explanation.
•	Stealth Viruses – about 1/3, but no-one attempted a definition.
•	Worms – nearly ¾ of the group mentioned these, and several described them with varying degrees of accuracy.
•	Trojan Horse – about 2/3 (one mentioned non-replication – others seemed to think it was a virus type)
•	Backdoor – mentioned by one respondent, but not described.

Two respondents got confused between specific viruses and virus types, and referred to a specific virus as if it were a category (two out of the three below came from the same respondent):.
•	Melissa – 1 respondent
•	Michelangelo – 1 respondent
•	Form – 1 respondent 

One respondent, who was probably attempting to distinguish between viruses, worms and Trojans, referred to “Normal viruses”.
Null response – 1 respondent

How do viruses get passed onto your computer?

Email – 25% – one specifically mentioned attachments.
Downloads – one person mentioned downloads but didn’t specify further.
Instant Messaging – surprisingly, given how commonly this seems to be used within that age group, only one respondent mentioned this.
Browsing
Internet connection (3)
Attached to downloaded document
Attached to document (3)
Malicious web site
Filesharing (kazaa, limewire, emule, edonkey, exeem, kiwi alpha, limewire pro, iTunes)
Floppy disk boot sector (1) One believed them to be the most common type of virus (those were the days!), but described them in some (mostly accurate) detail.
Null response (2)

Why would someone send a virus across the Internet?

•	One person didn’t respond.
•	As a research project
•	Prank
•	Vandalism
•	To attack the products of specific companies
•	To send out a political message.
•	To take down a network or a standalone system such as a home PC (interesting that people of all ages often don’t think of an Internet-connected PC as networked).
•	To get hacking access, or to allow the hacker to see your screen (described in this case as a “backdoor virus”).
•	Get recognition for their achievement as a virus writer. 
•	To feel in control of a very large company.
•	Disliking someone to the point of wanting to destroy their PC.
•	To affect more people and maybe bring down an ISP.
•	To get back at a business that sacked them.
•	To get back at governments, if created on a large scale.

What must individuals and firms always do to be prepared for the threat of viruses?

•	Most mentioned anti-virus software. One distinguished between desktop and server AV. One mentioned Norton Internet by name, and one mentioned the need for frequent updates.
•	Almost as many mentioned firewalls, but didn’t display much understanding of how firewalls actually work, or the differences between software and corporate firewalls. One or two seemed to confuse firewalls with email filtering, and none distinguished between the types of malware that a firewall might protect against.
•	Two mentioned backup.

What does the term “social engineering” mean?

This got quite a few competent answers, several of which were almost identical, suggesting that they were largely lifted from similar googled sources. Indeed, a little subsequent googling revealed that some were lifted verbatim from whatis.com [6]. Some, however, managed to hit on links referring to social engineering in the context of IRC or IM messages tricking the victim into running malware, rather than in terms of conning people into revealing passwords and bypassing sound security procedures (unfortunately, no-one picked up on both these aspects). One or two mentioned “low-tech” or non-technical intrusion as opposed to hacking or cracking, and one specified such activities as dumpster diving and shoulder-surfing. It would have been more satisfying to have been able to discuss all these elements “live”, but hopefully most of them learned something from their research.

Name three types of web scams

Several responses came up with some variation on the “Dirty dozen” scams listed at http://www.ftc.gov/bcp/conline/pubs/alerts/doznalrt.htm - 

1. Business opportunities
2. Bulk email 
3. Chain letters 
4. Work-at-home schemes 
5. Health and diet scams 
6. Effortless income 
7. Free goods 
8. Investment opportunities 
9. Cable descrambler kits 
10. Guaranteed loans or credit, on easy terms 
11. Credit repair 
12. Vacation prize promotions 

None mentioned specifically mentioned phishing, 419s, lottery scams, mule recruitment etc. (some of these are alluded to in the above dirty dozen, but not really adequately covered). Nor, of course the sort of scam that’s more specifically aimed at businesses (fraudulent invoicing, personnel data harvesting, data protection scams etc.).

Clearly, the most important findings from this project are that a search engine can’t tell bad information from good, and that children can be impressively uncritical of what they read (and unscrupulous in what they plagiarize): but would the average adult (IT professionals excepted, hopefully) have done better? 

SUMMARY OF UK PRESENTATION BASED ON AREAS HIGHLIGHTED BY QUESTIONNAIRE RESPONSES

The answers to the written questionnaire completed by the first groups of children in Hampshire were used by David Harley as the basis for a fairly informal presentation and discussion with the same groups. While the full presentation was too long to be included here, it’s likely that a developed version will be available to anyone interested by the time this paper is presented. It included material on malware, spam and email abuse, identity theft and impersonation, and DoS attacks, though the shoehorning of each discussion into a regular lesson meant inevitably that not all these areas were actually discussed with all groups. 

In 2003 and 2004, Harley discussed somewhat similar material with adults in his own working environment in a number of “Lunch and Learn” sessions at offices around the UK. [2] His experience in these sessions suggested that the adults were, while not uninterested in malicious code, passionately interested in spam and email abuse, which they generally regarded as a far more pertinent threat to their working environment. The combination of a shorter session and the fact that a high proportion of the teenage audience were very enthusiastic about discussing malicious code meant that we never reached some of the later portions of the presentation that dealt with those areas, so it’s not known whether the same would have applied to the younger audience.

The significant differences between forms of malicious code were discussed in some detail, including some of the more relevant sub-classifications and -mechanisms.
•	Viruses
•	Worms
•	Trojan horses
•	Adware and Spyware
•	Bots/botnets, 

A number of questions were posed by the presenter or audience that gave rise to lively discussion, including:
•	“If you can only tell that you have a virus because your anti-virus tells you so, does it matter if it’s there or not?”
•	“What’s the difference between a hacker and a virus writer?”
•	“Can a virus damage hardware?”
•	“Is virus writing illegal? Is hacking? Is spamming.”
•	“What’s good/bad about virus writing?”
•	“Is there such a thing as a good virus?” – this discussion made use of a real-life example of an Excel macro detected heuristically (and perfectly defensibly) as a virus.
•	“How many viruses are there, and how many of them do you need to worry about?”
•	Mass-mailers were also discussed at length, particularly relating to some of the popular fallacies that surround them, and the question was raised and explored as to how far virus-specific anti-virus could be trusted to close “Windows of Vulnerability”, using (by permission) research by Andreas Marx at the University of Magdeburg into outbreak response testing [3].

Other issues could have been addressed in more detail if time allowed, for example, under the general category of spam:
•	UCE/UBE
•	SPIM
•	Text spam
•	Fraud
o	Advance fee fraud
o	Phishing/Pharming/Moneylaundering
o	Pyramid schemes et al
o	Cellphone fraud
o	Auction fraud
o	Money mule recruitment
•	Hoaxes, chain letters

It might be asked why kids need to be aware of the finer shades of fraud, to take an example of an area of crime activity generally aimed at adults. There are several convincing reasons. The children in these groups were already old enough to have part time jobs and nearly old enough to leave school. While not technically adults ( at any rate according to UK culture and law), they were old enough to be exposed to such material (a bot or a phisher doesn’t usually know or care if you’re under 16), and might have access to such facilities as credit cards (with or without the permission of the owner), and indeed might already have bank accounts, debit cards and the like, though in general the facilities extended to pre-adults tend to be restricted. What’s more, their generation is often assumed (not necessarily strictly correctly) by older generations to be far more knowledgeable and technically proficient in the online world. This puts surprising power into the hands of children. Not only might they endanger their parents’ online welfare by offering wrong information, they might also confirm Appleman’s [4] more optimistic view that “not only can teens be a part of the overall solution to this problem, but they can also take the lead.”

Much the same can apply in other areas: teenagers and younger are often far more adept) at SMS texting and instant messaging and chat facilities (or at least accustomed to using them) than their elders and therefore exposed to all the attendant risks. They can also be even more vulnerable to misinformation of the chain letter kind. It was only when researching a presentation [5] on email abuse related to the tragic tsunami of 2004 that one of the authors, an alleged authority on hoaxes and urban legends, was introduced to a subclass of chain-letters, promising that if the recipient forwarded the chain email, something wonderful would happen to them at a very specific time that evening. (This little gem emerged into the adult world attached to the “tsunami ribbon” hoax.)

The pornography problem was not considered at length on this occasion: not that we understate its importance (or complexity), but because it is the problem most often addressed in research (if not always very well). However, since some questionnaire responses construed the question about safe surfing to refer to this problem and specific mention was made of Google SafeSearch, the opportunity was taken to refer to research [7] investigating some of the problems with this approach, as a general introduction to filtering problems.

Paedophilia was not discussed, for lack of time. Clearly, such issues as contact and grooming could profitably be explored at length with such an audience.

Other areas that weren’t much explored on this occasion but certainly could be in a follow-up study included:
•	IT, ethics and morality
•	Anonymity
•	Countermeasures – their nature and differences, and their efficacy in different contexts:
o	AV
o	Anti-spam
o	Anti-adware/spyware
o	Personal firewalls
o	Broadband/Wi-Fi/Bluetooth security
•	Encryption and authentication
o	What is it, and how does it work?
o	Where is it appropriate?
o	What is an effective password?
o	What alternative means of authentication are there?
o	Is an encrypted object always safe and secure?
•	Personal abuse and Netiquette
•	Identity Theft
•	Piracy and file-sharing
•	How does online social interaction resemble and differ from other forms? Do similar castes, cliques and social groupings apply? (Chavs, townies, grungers, Goths, individuals and other groups based on lifestyle, clothing and favoured music, even teen-witch aspirations [8].

Conclusion

What are the implications for educators of this project? Teachers in many parts of the world do not have a great deal of autonomy in what and how they teach. In the UK at least, ICT (Information and Communication Technology) teaching is an area still developing in content and resource terms, and a brief informal survey of teaching materials current in the UK and having particular reference to the subject matter of this paper shows a wide range of accuracy and relevance. While other information security issues are often covered with reasonable accuracy, albeit superficially, malicious code issues are, even if not actually inaccurate in the context of the time of publication, seriously out-of-date. Some examples follow.

•	A revision guide published in 2001 [9] defines a virus, not unreasonably, as a program that copies itself, but doesn’t discuss Trojans or worms (let alone more recent threats such as botnets): it refers to virus risk from employees’ floppies but doesn’t extrapolate to other (more current) removable media such as writeable CDs and pen drives, and makes no reference to spoofing mass mailers, for example. In these instanced, the information is not exactly incorrect, but virus technology has moved on.
•	A multiple choice question in a more recent guide [10] by the same author asks the reader to select just one of the four answers following to the question “Which of the following is a sensible precaution against viruses?”:
a)	Don’t use downloaded executables
b)	Don’t let employees make their own applications
c)	Don’t download wallpaper from the Internet
d)	Always disallow macros in word processed documents.
The right answer in this case is deemed to be (a), which does make sense in general, though it’s not difficult to think of instances in which such a rule would be not only inconvenient but counterproductive (the download of a (verified and authorized) anti-virus product, for example). But it’s also possible to argue for (or against!) the other options (in-house vx aspirants, deceptive graphics, risk from macro viruses…). Admittedly similar objections can be raised to other multiple choice scenarios such as the CISSP exam. The problem here is not with the teaching material as such, which is “correct” within the context of the general level of understanding of those administering the National Curriculum.
•	Another example [11] gives an admirably clear description of how anti-virus software works but spoils it by stating that “For virus-scanning programs to be effective their list of known viruses needs to be updated at least once every six months.” Others include good material on subjects such as ethical issues, computer crime and legislation, and corporate ICT policies, but state authoritatively (but incorrectly) that macro viruses are increasingly the commonest form of virus [12] and that “The first virus appeared at the University of Delaware in 1987.” [13]
Conventional books from mainstream publishers, including textbooks, can have very long lead times: in a fast-moving industry like IT (let alone the security sector) information in this area is always likely to be out-of-date before it hits Amazon. And, given the amount of virus-, fraud- and spam-related misinformation available, it’s understandable and even forgivable that non-specialists sometimes mistake inaccurate information they encounter in their research for sound data. Nor would it be fair to suggest that educationalists are more vulnerable to misconceptions than anyone else outside the charmed circle of the AV community.

Nevertheless, the problem remains. It’s perfectly possible to give a pupil security information that will be sufficient to enable them to pass an examination, but is inaccurate enough to increase their vulnerability to attack in the real online world. 

Are children more or less vulnerable than adults?
•	Most of the security issues applicable to home users apply to their children, and in some cases more so. Children may be more vulnerable because likelier to make more use of contexts of maximum exposure (chat rooms, instant messaging, home email). Of course, they’re also, by virtue of their age more vulnerable to attacks from predatory paedophiles, and their inexperience also opens them to exploitation by criminals and vandals as a springboard to their parent’s passwords, banking data etc. 
•	They’re often encouraged by previous generations to regard themselves as “expert”: however, much of this expertise is illusory (using google and email is not evidence of ICT expertise), and where it exists is not necessarily in the security arena (which, as we’ve seen, is in any case awash with misinformation).
•	They may not have the moral/ethical grounding to deal with the context, because previous generations have failed to apply moral guidance to the online context (and we’ve failed to communicate the problems to them). Indeed, it’s been suggested that older generations may be no better equipped to apply conventional morality to some online transaction, though fear of the technology itself might have a “moral” influence [14].
•	Advertising departments, media, law enforcement, IT-illiterate educationalists, government etc have talked up the expertise of the hacker and virus writing communities and therefore increased the glamour of illicit activity. 

In his original article in Virus Bulletin, Eddy Willems said in his conclusion “If we want to change people’s behaviour and reduce the attractiveness of becoming a virus writer or hacker, we must start ethical computer education at a much earlier age … So why not incorporate this information into the MEGA lessons or the DARE project and start educating our children at a much earlier age?” This is a sound starting point, but I would contend that we could afford to think more globally. Other issues that need to be addressed include the reliance of teachers and parents who rarely happen to be security experts on a wide range of conflicting information from many sources, including“official” teaching materials and government web sites. This scenario would seem to cry out for something like the WARP (Warning, Advice and Reporting Points) approach. A well-publicised and soundly-administered web site could offer not only the standard WARP deliverables such as the bullet points below [15], but also such goodies as links to trustworthy sites associated with vendors and other players in the security space, particularly those that address the concerns of home users and educationalists:

•	A trusted environment 
•	Security information filtering 
•	Access to expert advice 
•	Early warning of threats 
•	Strategic decision support 
•	Improved awareness 

While the strictures upon such organizations regarding commercial interest might generate funding issues, such a “kidzWARP” might, for instance, generate self-funding by the provision of for-fee consultancy services and specialist educational materials.

Watch this space!

Some Resources
•	WARP toolbox: http://www.warp.gov.uk/ 
•	IWF (Internet Watch Foundation): http://www.iwf.org.uk/ [UK reporting point for illegal content including child abuse images]
•	Inhope: http://www.inhope.org/en/index.html [coordination of Internet hotlines in responding to illegal use and content on the Internet]
•	ITsafe – UK government resource for home users and small businesses: http://www.itsafe.gov.uk/ - somewhat thin on content, and its information tends to be seriously oversimplified, but may do better in time.
•	US-CERT resources for home and corporate users, and newbies: http://www.us-cert.gov/nav//nt01/ [Some of the security tips content is a bit dubious, but generally does what it says on the tin.]
•	“Cyber-Safety for Everyone: from Kids to Elders”, M. E. Kabay, PhD, CISSP: http://www2.norwich.edu/mkabay/cyberwatch/cybersafety.pdf
•	Safer Internet thematic portal: http://europa.eu.int/information_society/activities/sip/index_en.htm
•	Internet & Computer Ethics for Kids (and Their Parents & Teachers Who Haven't Got a Clue), Winn Schwartau: http://www.thesecurityawarenesscompany.com/chez/chez.php 
•	http://www.cabinetoffice.gov.uk/csia/protecting_our_information_systems/promoting_awareness.asp
•	British Educational Communications and Technology Agency: http://www.becta.org.uk/
•	DFeS Superhighway Safety Site: http://safety.ngfl.gov.uk/?sec=9&cat=99&clear=y
o	http://safety.ngfl.gov.uk/schools
o	http://safety.ngfl.gov.uk/ukonline
o	http://www.parentscentre.gov.uk/usingtheinternet/internetsafety/
•	Microsoft home securitypage: http://www.microsoft.com/athome/security/default.mspx
•	http://alwaysuseprotection.com/ 

References

[1] Eddy Willems, “The End of Cybercrime?”: Virus Bulletin, August 2004.
[2] David Harley, “The Email of the Species Revisited”: presentation for the NHS Information Authority, 2003-4.
[3] Andreas Marx, personal communication and “Anti-Virus Outbreak Response Testing and Impact”: Virus Bulletin Conference Presentation, 2004. 
[4] Dan Appleman, “Always use protection – a teen’s guide to safe computing”: Apress/Springer, 2004.
[5] David Harley, “Viruses of the Mind Re-Visited (Return of the Memetic Virus) or How the NHS was Swamped by the Tsunami”: presentation for UK CERTs, 2005. 
[6] http://searchsecurity.techtarget.com/sDefinition/0,,sid14_gci531120,00.html
 [7] Benjamin Edelman, “Empirical Analysis of Google SafeSearch”: http://cyber.law.harvard.edu/people/edelman/google-safesearch/.
[8] Adi Bloom, “The web casts spell on teen cliques”, Times Education Supplement, June 3rd 2005. 
[9] Sean O’Byrne, “GCSE Success Visual Revision Guide ICT”, Letts Educational, 2001.
[10] Sean O’Byrne, “Letts GCSE Success Visual Revision Guide Questions & Answers ICT”, Letts Educational, 2003.
[11] P. Evans, “GCSE Information and Communication Technology 2nd Edition”, Payne-Gallway, 2000.
[12] Alan Gardner, “AS & A Level ICT through diagrams”, Oxford University Press, 2002.
[13] P.M. Heathcote, “’A’ Level ICT 3rd Edition”, Payne-Gallway, 2003. 
[14] David Harley, Robert Slade, Urs Gattiker: “Viruses Revealed” Chapter 18: Osborne, 2001.
[15] http://www.niscc.gov.uk/niscc/warpInfo-en.html