Requirements for ICT security in ECE services
Functional Requirements
The two main functional requirements for ICT security in ECE Services are the security of business data and the security and safety of children.
Security of business data includes:
- prevention of unauthorised access (and inappropriate use)
- prevention of data loss through data corruption, equipment failure or equipment theft
Security of children includes:
- protection from inappropriate material
- protection from inappropriate persons
- protection from exploitation
- protection from accidental harm
Acceptable Use Policies
The use of digital technologies, such as still and video cameras, is exciting, and the internet provides an almost unlimited educational resource and a facility to communicate, display, and revisit the results of our work. Unfortunately, many organisations take advantage of ICT before even thinking about what constitutes acceptable and responsible use or implementing cybersafety policies.
It is imperative that everybody involved with an ECE Service understands their responsibilities with respect to acceptable use of ICT. Acceptable Use Policies for ICT equipment and services should be implemented.
Following wide consultation with the ECE sector, Netsafe, the Internet Safety Group, has developed Acceptable Use Policy templates for ECE Services, ECE Services Personnel, and Parents/Caregivers. The templates may be downloaded from Netsafe.
These policy templates cover:
- What ICT equipment may be used
- Whose ICT equipment may be used
- What ICT equipment may be used for
- Who can use ICT equipment
- How ICT equipment may be used
- What information or material may be collected or accessed
- Who may access information or material
- How information is protected
- How to respond to breaches of the policy
The templates, as they stand, permit the use of privately-owned ICT equipment at ECE Services. The use of privately-owned ICT equipment, other than by staff, creates a high potential not only for undetectable breaches of the Acceptable Use Policy but also data security, and should be discouraged.
What ICT Equipment is Acceptable?
The use of ECE Service-owned ICT equipment for its intended educational purpose by or under the control of an ECE educator is generally acceptable. The use of privately-owned ICT equipment that captures and stores or transmits images, or is able to access ECE Service information is potentially unacceptable in any ECE Service except for educators or other professionals who have signed an acceptable use agreement.
This includes:
- Cameras – still and movie, both digital and film
- Mobile phones with cameras – virtually all mobile phones
- Computers, laptops, and PDAs
In practice, it will be difficult for ECE Service staff to control how visitors to a Service use ICT equipment, and while the supervisor will exercise discretion to permit use in some situations, e.g. a birthday celebration, it may be necessary for others to prohibit the use of privately-owned equipment rather than risk improper images of children or business information being transmitted off-site.
What Activities are Acceptable?
Taking photographs (digital or film) of children that are respectful of them and appropriate to the learning situation with ECE Service-owned cameras by, or under the supervision of, an ECE educator, is generally acceptable.
The use of ECE Service-owned ICT equipment for normal educational and administrative purposes by or under the supervision of an ECE educator or administrator is acceptable.
What Material is Unacceptable?
Objectionable material and information includes that which may be deemed pornographic, sexually explicit or offensive, hateful or violent in nature, or that which encourages activities that are dangerous or illegal. Some information promotes extreme political, violent, racist or sexist views. These types of material are widely available on the internet.
Exposure to such material may occur inadvertently through normal and legitimate searching activities or by unsolicited email delivery. Educators shall be aware of safe searching techniques and provide information to children on how to react and deal with unsolicited, inappropriate material.
What may be regarded as not objectionable under the Films, Videos, and Publications Classification Act may, nevertheless, be inappropriate and harmful to children given the impact of the medium in which the publication is presented and the age of the children to whom the publication is available.
What is Cybersafety?
NetSafe defines cybersafety as “the safe and responsible use of Information and Communication Technologies”. “Safe and responsible use” suggests that not only are the proper technical safeguards put in place but also that the user, by virtue of training and experience, has learned to respect the internet and is able to protect themselves.
Small children, by this definition, are not “safe and responsible” users and ECE educators and parents need to ensure that the proper technical safeguards and rules for internet use are implemented and that children progressively learn to protect themselves.