Accept, Mitigate, Avoid: Rethinking Cyber Risk For The Next Generation - Jack W

Okay, thank you for coming everyone. My name is Jack. I'm a sock analyst at a company called Chorus. Um, we're a sock and cyber security based company. Last year I spoke here about fishing and had a lot more people in the room. Um, but the sequel's never as good as it. So, not so technical this time. A bit more I want to say political but um more of a educational one. I want to talk about cyber to children and why we can't accept them and why we can't avoid them and why the solution is to mitigate them. So I want to start with a story. But before I do, who here has kids? And of those children who who think they

are completely safe online? Great. That's the point. So back to the story. When I was a kid, I love computers and I still do. and I this big white desktop coming out heat and trying to work out what I could do on it, break it. Um, to the dismay of my dad, I with a bit of Google worked out how to become admin and reset the password to download the next crack game or Lime Wire and fill it up with viruses again and again. That um that obviously is frustrating. I didn't know what I was doing. I didn't assess the risk of what I was doing because who does if you're a kid there isn't a risk um to them anyway that was

my real risk decision my first one I was pushing the boundaries trying to see what I could do and make choices where understanding the consequences and that was okay back then but now if you compare that to today the risks children face online are much bigger it's not just the dodgy downloads anymore social media cyber bullying even sectioning scams and sometimes to the extent of radicalization. Obviously, we're not talking about all children here. Some of them are minorities, but it still does happen. Whole movements like the manosphere are becoming a problem, but that's a whole talk on its own. I won't go into that. Then there's things like AI generated deep fakes, VR environments, online

gaming communities that open doors to predators and make it very easy for them to groom children like platforms like Fortnite and Roblox. And the risks are now more complex. The consequences can be life-changing because your internet presence is your CV. It's your reputation. It's your history. And that sticks with children. I'd do a lot less damage then than I could do now with the same amount of fix things I would do. So, it's more important that children know that if they can do something, it's going to stay online. It's going to be everywhere and they may or probably will not control it. So, in cyber security, risk is at the heart of everything we do. we make

split-second decisions um or we plan risk reduction through frameworks and policies. So why aren't we children teaching children to do it in exactly the same way to an extent? We need a structured approach that we already use in cyber security to help children stay safe online and help future proof their online security. At its core, cyber security is about risk and we accept some risks because the uh risk is low enough. We manage risks through controls, education, monitoring or we should avoid them all together by not engaging with the risk and just not doing the thing that is risky. But we need to take that approach now to children because too many parents and teachers

are having to either avoid it or accept it. Either the education or the resources aren't there and most of the time through no fault of their own or sometimes ignorance. They're not doing what they could do to protect the children online.

So sometimes a lot of parents don't know how to mitigate. They're not into IT or cyber or tech. They don't know a lot of the technologies and it's a lot harder now to do that. So we could ban it. Great option, but I I don't think that's going to work. Any 13y olds with a bit of an idea of how to use a computer can get past this in minutes. Um, and we're not going to go VPN, are we? It's it's it's a it's a sore subject. It's um something it's a debate, but I don't believe that this is it's not a foolproof solution, is it? It's just we're changing the direction of the children if they go in a straight

line and safe route where we want to be. We're now banning them. It may not be the end, might not be where we want them to be, but they've got a safe way. So now we're saying you need to find a way to get there. You're now going to drop into all these different things, these alleys, and where you're going to end up, and you're going to find even worse things on the way to the thing you're trying to find anyway. So is it a solution? No. But parents often say that now kids are digital natives. And that may be to a point correct, but they also use the same password on everything they do.

It's probably quite easily guessable and they fall for scams. They don't see the dangers and the blind accept acceptance, sorry, just leaves them exposed. And the right approach is the mitigation, educating, guiding, giving the children the tools and the choices to make better decisions. Children are more advanced to cyber. need the options to not go down these dark paths and have options to do it for better and actually make they can make a career out of it or they can just stay away from doing things they shouldn't be doing or didn't realize was going to be a risk and now has become a problem because they've affected someone or something or just hit a a company

through just fun cuz that's all it is to them. is fun and so for some of us it is fun but we can associate risk with it where they don't. So what's the solution? We can't avoid the risk. We know that and we can't blindly just accept it. We need to mitigate it and that means preparing kids for what might happen when it happens. giving them the tools, knowing who to speak to, knowing what to do, because it's not wrong if something goes wrong. It's not bad if something goes wrong. It can be bad, but it's not bad thing that they've done. Essentially, we need to know where to go and what we can do to help them do this.

So that looks like here education and open conversations, practical cyber hygiene and struggle pastors. Um an awareness of that reputation that's going to follow them that could affect them 20 years down the line when they're trying to get a job. I've seen several of people that are trying to get jobs and they didn't found something on their Twitter was posted when they were in uni or something and they it's just fun. It's funny at the time, but it's not because it's going to keep on hitting down the road and assess where do we actually need to post this online? What are we getting from it? Is the whole situation of our September school pictures in front of the door with your

primary badge in it? What what we actually doing there? We're exposing the child to risk. They don't have a say in who controls their digital privacy. The parent is responsible for that. And then you're stripping this away from the child saying I'm going to throw your internet price out the window when you can't join about it now but in 10 years time when you can do something about it I've already done it for you. So that's what we need to think about as well and how platforms like Snapchat and the non-repreation of messages. So, I'm a school governor and even texting in schools at primary level is a problem. And that's horrible to think, but it is.

It's happening in year fives, year sixes, year sevens because once messages are gone and we're just enticing cyber bullying through it because it can it's gone. What's the problem now? there's no consequence to it. Is educating them that on when you send it that's wrong for you and that you send something it's probably not going to come back on you. And that's the whole point is where we want to have this time where we can know who's done what to an extent and making education is needs to be engaging cuz the current resources and the budgets that are assigned to IC and cyber education are falling behind if not getting stopped completely. In in my school, we can't barely afford

glue sticks. We're getting stripped everything we can and be left aparts by people that own it. It's not ideal, but we get given a downloadable PDF of a tick box and the teachers doing it barely knows that what the resource themselves. There isn't a resource of the teachers to know what they're that have that much knowledge to give the kids a detailed understanding of what they're actually doing online. and the resources we've been given, they're not engaging. Write a poster about cyber bullying. Great. 20 minutes done. But what's actually done for us? Post about everything. We need content that's engaging, thoughtprovoking, and actually changes things. Otherwise, we we're doing the same side education as we were doing in schools 10 years

ago. The same as the whole the whole education sector. So interactive content like Cyber being the example. I don't have a better example. I don't want to have a better example. This is a great resource. It's things like this that are going to grow and be engaging for children. I tried this myself on my children and I just let them have it. Let them do it and see what they could do. And they instantly engaged with it and was sort of they knew how to do it already. um because it's so similar to the platforms they're already on it similar to things like Roblox in a way and to the gamification I mean um and that

that's what we need and these things are not costing school millions but it's having a way to deliver them and if kids can do this sort of stuff and actually have some more technical knowledge because a lot of kids they don't want just the basics some of the kids are quite bright they can do more and understand more and have this knowledge. It's not just don't do this, why we're not doing it and what's it going to do? You can't say don't do this, don't do that. Yeah, but why they want to know why are not stupid at the end of the day when we're trying to the people and the kids that are are engaging in in cyber IT at

their their age that hunger for it comes from not knowing. So that's where we can improve. And by avoiding it, it's like telling a kid you can never cross a road again. That's avoided sorted. They're not going to get run over. Whereas we just teach them how to cross the road safely and we tell them what's right and what's wrong to look out for and how to do it. And exactly the same. There's not much different. Just teach them how to do it, why to do it, what's not to do, and what to look out for. And as we know, we can't avoid the risks. The children will be online. We can't say, "Well, we'll ban YouTube.

We'll ban Roblox Fortnite." Where that leave us now. Your kids are behind everyone else or their friends at school. They're not being bullied cuz they don't get to go on it. They don't they don't know the the latest things, the latest characters, the latest problems. They don't have to be on this stuff. But a lot of kids want to be on this stuff and it can be done in a safe manner. So we can't avoid them and these platforms and even Tik Tok and YouTube can be used for such creative purposes, educational purposes. So I taking that part away from them just because we don't want to manage the risk. We it's just easy to

avoid the risk as we've seen with a certain government and we can't just write regulations. Imagine if the money we poured however it is into the online safety act and use it for schools for online safety training where actually needs to be cuz the whole purpose of it isn't giving children safe online. Why don't we use this money for actual schools that are actually engaging kind of people and not just a blanket ban? It's not for everyone. It doesn't need to be. And that's the cyber cyber professionals stepping in and sharing knowledge, stories, platforms, building resources that we can use. And it's about safeguarding the next generation. If we don't do something, they're going to work around these restrictions. as I

said and do whatever they like and we spent and the government spent all this money to what have a blocker that we just jump over. It's just adding a few minutes to just makes it more fun for the kids cuz they know now we to get around this now an extra bit we've just succeeded. So our mis integration strategy has been not just educating the children. The parents need the education. A lot of parents don't know. Loads of older parents now that don't know the new technology don't use it. So why are we not teaching them to we don't have to be patronized about it. We can it's just about showing risk of what's going to happen, what could happen when

it happens. You see every day now of what happens. So if we can if we get government support the education and not just writing regulations that be amazing and then showing up resource like cyberhood showing up and building resources for children all over the world to be able to actually stay safe and build a great online future that you can have and not just not know what the incident is anymore. We don't need to go backwards because of it. And um just another meme for you to keep you engaged just in case. And we know so we know for a fact the government are going to do this alone if at all. The responsibility lies with parents,

teachers and cyber security community. And that's what our opportunity is now is to use we have and try and pass over and use cuz we're the best people to do it right or we would hope to anyway. And that is my view on internet safety and children for children currently. Thank you. [Applause] >> Any questions? >> Yeah. >> Hi there. Thank you very much DJ. I have to say I'm a secondary school teacher. Uh I've been coming on to B sides for three years. Um this is my third one. Um, thank you for raising awareness first and foremost and you're absolutely right. I mean the picture you pay education is strapped for cash, strapped for time, strapped for resources,

strapped for expertise for everything. >> Um, secondary schools most don't have specialist teachers, most don't have the knowledge and understanding. Uh, most approaches around blocking sites kids are posting and typing and so on. The the monitoring system has improved massively. So I feel like it's a lot safer if they type key words in that up very quickly but it does cause problems when my classes research hashing for example. Um but I just wanted I know the approach we've taken in our secondary school um I mean we're a cyber first school we met STEM ambassadors I reach out to people through making contacts events like this so for security so yam and here's the person came to school

this year and talk to our year sevens our year 10 our staff our parents but what sort of approaches do you take with your primary school as a as primary governor what are the things that you bring to the table and how do you get that sort of is stra time resources actually move forwards what things work >> the governors have to give up the time that's it we have no other way doing it we can't even afford to win 11 now so and the question the answer was from from trust whatever so it's all us different governor trying to give up our time where we can we've just replaced all the interact whiteboards by just basically

flirting with different companies to try and get get stuff out of them. And parents don't want to know. They could not care less. A lot of parents want to give their kids the Roblox or Fortnite and just do it. So it's just hoping more so it we're going to get free now to trying to teach them this stuff illustrating because now the the age of someone getting phone is a lot lower. So we're trying to teach them now what they're going to come in contact with and just hoping that what we we do go into a certain extent. There's only so much we can do and then unfortunately it's just even the fallout right now and

the teachers are better at that because it's safeguarding. That's a more topic they're good at. It shouldn't be like that unfortunately. We can only try. >> Thank you. Thank you. >> So the problem is the same across the whole society. >> Yeah. >> In businesses, outside things like that, old people, young people, everybody everywhere. >> And within businesses, they are starting to realize that it's not a choice. It's not an option thing. It's a must. having that switch within [Music] every single company and it becomes a non-negotiable that's when >> yeah that's when they have to they will >> think should we do this or shouldn't we choice >> and they say when it was years and years

ago you'll be privileged to have a computer in your school it's no better now great have computers in the biggest schools and the best schools, we just have terrible resources just they're not fit for purpose and it all get to the point where we have to deal with it. It's the same as the when the the mitigation is getting too bad where we're just dealing with incident after incident of children doing stuff online because the schools now deal with stuff that's happening at home because it relates to students in schools and things like that. the the it's getting very blurred of where does that end and where does it start where you where what what is your scope for that where you're

trying to look after the children because again a lot of the parents the evidence gone well I wouldn't do that great so when I look at like the online safety and child online I think about factories so people used to die in factories all the people people there's accident after accident. I think maybe we should have health and safety involved and now people less dying dying batteries and they're safer than they've ever been with budgets cuz they're forced to do it. Um you look at child online safety and there's horror stories out there. So um one horror story is um a girl was rescued from Mac. She's been sexually abused and it turns out the um a year

later they keep finding images videos of her same girl abused. It turns out what actually happened was the abuser took so much video videos and images that it got linked and someone made a deep fake engine. They could make her do anything or anything happened to her. And that's a shocking story, right? But you hear what all the time about kids killing themselves or this happen and I wonder if we ever thought what's going to actually going to take like dead to force to happen because unfortunately kids are dying getting abused and every single day without there's not a minute this doesn't happen but yet there's no health and safety people stepping in and saying actually maybe we should have

ladders in ladders or fire fire exits signs and I was wondering if you ever thought about that what would actually take because I can't think of anything more horrifying through now a story that's going to trigger something. So what what would you think needs needs to change for the world to change like that? >> The only way is educating them at the early stage of that I need to post this online because that can be turned into a deep fake but because the problem is the industry makes too much money child sexual abuse and the content that makes a lot of money for the people that make it. We're sickening in but it's a fact

and we can't hide that fact. So it's never going to stop but each children child that you come across needs to know that does I really need to go online can I change that picture to maybe not include my face be oh you can post that's not the problem but maybe not do it so you don't need to be so open you know >> do you think one of the biggest challenges out there be the communication side as you mentioned before um parents having conversations with their kids about what they're doing even if they're uncomfortable um I found previously if you have communication between say teachers parents and students it makes things a little bit easier

would you say communication big thing that needs to be worked on as well >> so we had the idea of running workshops for the parents to understand the risks you want to Can we not use like a really good ideas that just like as you said like in schools you have like monitoring system so as we can keywords we monitor we might be able to monitor images you know just like the solution cuz you like one night >> the problem really stems from schools it doesn't actually happen in schools it's 3:30 when we break out we're all going on they're all going on their phones and sending pictures everywhere being their mate cuz they're waiting that for the

it's not actually in school and until something happens to your child. >> Sorry guys, I'm going to have to stop here cuz we're running out of time. Here's a really passionate subject and I have questions as well. I definitely want to continue the conversation around speaker. So yeah, please grab Jack. [Applause]