Better Internet for Kids

A key skill needed by both children and adults online is cybersecurity: protecting your devices, online accounts and personal data from unauthorised access. It is important for you to know how to protect yourself as individual, and many of the steps you can take can also be taught to your child to encourage them to be cybersecure, even from a young age.

This deep dive will explore cybersecurity strategies that are useful for all family members, as well as some of the most common forms of cybercrime that you or your child may encounter online, specifically online scams such as phishing, and the use of malware.

Internet connected devices (such as smartphones, games consoles and computers) are a common part of modern life for many families. Depending on your family’s approach to using technology, there may be a range of devices that are used to access online services. Your child may also have their own devices and their own accounts, including social media, email and gaming accounts.

The personal data stored in online accounts and devices is valuable to criminals, particularly data related to accessing finances or possessions.

Getting into positive habits around privacy and security is important for everyone in your family to help avoid becoming the victims of cybercrime. It is also useful to learn how to spot common attempts online by criminals to steal personal data, possessions or money – the more aware you are, the easier it is to spot when a cybercriminal is trying to trick you or your family online.

There are two main types of cybercrime:

• cyber-enabled crime – traditional crimes that can be enhanced by technology (for example, child sexual exploitation, blackmail, fraud, extortion and drug smuggling).
• cyber-dependent crime – crimes that can only occur through the use of the internet and technology (for example, hacking, cyberespionage, data theft, and malware).

This deep dive will mainly focus on the ways that you and your family can protect yourself from cyber-dependent crime, although many of these strategies can also help reduce the risk of other crimes such as fraud, identity theft or extortion.

Your personal data is valuable to online companies but also to cybercriminals. With enough personal data, a cybercriminal could:

• Access your online accounts that enable them to collect/steal more personal data.
• Sell personal data (such as credit card details, account passwords, etc.) to other criminals online.
• Impersonate you – either to commit fraud or to commit acts that might damage your reputation, well-being or safety.
• Hijack your accounts/devices to use in other crimes, such as using them as part of a coordinated attack alongside other hacked accounts/devices to take down a website. This is often referred to as a ‘botnet’.

Thanks to the wide variety of online services, online scams can take many different forms:

Regardless of the type, the motive is always the same – to trick an online user into giving away personal data or other information in order for a scammer to defraud them or take advantage of another person, usually for financial gain.

Consider the following scams and how likely they might be to affect your child.

Phishing is a common technique used by cybercriminals to trick users into revealing their personal data by pretending to be popular online products and services. The most common form of phishing is an email that appears to be from a trusted source such as your bank or an online service you use (such as Netflix) asking you to confirm or update your account details. These emails always include a link to a fake webpage - it looks like the genuine site but is designed to steal any personal data entered (like usernames and passwords). Criminals can then use your details to gain access to your real account. This can also occur through SMS messages on mobile devices – commonly referred to as ‘smishing’.

Young people can also be targeted by online scams; the Phishers’ Favorites report found that many of the top 20 impersonated brands online are ones popular with children and young people (such as Facebook, Microsoft, Google, WhatsApp, Netflix, Apple and Instagram).

Here are five things that can help you spot a phishing email:

1. Sent from a public email domain – a message from a large genuine company (like Disney+ or TikTok) will never be sent from an email address such as @gmail.com or @outlook.com.
2. Misspelt domain name – if the email domain is misspelt, or the website it links to contains a misspelt web address then these could also be clues that they are not genuine. Some scammers will buy up misspelt web address that closely mimic genuine ones e.g. www.göögle.com as this can easily fool people who might glance at the address rather than studying it in detail.
3. Poor grammar or spelling – these can be indications that the email isn’t genuine. However, artificial intelligence tools are making it easier for cybercriminals to translate from their native language into other languages with a high degree of accuracy.
4. Suspicious attachments or links – emails containing attachments (often shown by a paperclip symbol) or you to click on a link may be hiding a piece of malicious software (malware). Files can easily be renamed to something that might tempt you to open it e.g. ‘invoice.pdf’.
5. A sense of urgency – emails that prompt you to take immediate action, such as an urgent email from your boss asking you to send information, or a message that appears to be from an online service threatening to suspend your account, could be phishing attempts. Rushing you into taking action gives you less opportunity to examine the email closely and spot any clues that might give it away as fake.

Malware is malicious software that is disguised as a file, software or app to trick a user into opening, downloading or installing it onto their device. 

This article summarises the different types of malware that can be used to acquire personal data from others, but they typically include adwares, botnets, keyloggers, cryptocurrency miners, ransomwares, rootkits, spywares, trojans, viruses and worms.

One form of malware that presents risks to individuals but also to organisations (including schools) is ransomware, which infects a device, encrypts (locks) the files and sends a ransom message to the user.

Law enforcement advise that you should never pay the ransom to a cybercriminal – there is no guarantee they will return control of your files or never return in the future to extort more money. 

Ransomware is a crime and should be reported to local law enforcement – The No More Ransom project site contains details of who to report to in your country, as well as details of free decryption tools that exist for certain malware types, so that users can attempt to unlock their files rather than lose them forever.

One of the most effective ways to protect your data is to ensure that you use strong and memorable passwords on every online account and use a different password for each one.

The best passwords are based on three or four random words. There are a number of ways you can do this – you could use a random word generator, use a strategy like Diceware, or even make your own password dice to generate unique passwords, using the ‘Making Strong Passphrases’ activity on the School of Social Networks – a great activity to do with your child!

This chart (originally developed by Hive Systems) demonstrates why longer passwords are stronger:

However, trying to remember dozens of passwords is still tricky! So using a password manager app on your device to store all your log in details can make life easier. You can then secure the app with a strong memorable password – now you only have to remember one password in order to access all your passwords! (Be sure to keep this password secret!)

It is also recommended to use a strong password for your email accounts. If a cybercriminal can guess your email password, they can use your account to reset the passwords on all the services you have used it to sign up for.

The following are strategies that all users (child or adult) can benefit from to strengthen their online security and reduce the chances of personal data or accounts being stolen or hacked: