(ISC)2 Blog

Technology that compels reasonable people to make questionable choices

Parents, have you heard of Snapchat? It was the first messaging applications, referred to as ephemeral technology, that allows one to send an image or video to one person or a group of people. This doesn't sound either new or novel. Right? Well, the spin with these apps that by definition, lasting a very short time, the sender sets the period the image or video is available to view, from one up to ten seconds.

Now you see where I'm going. The appeal is that the image or video in essence expires or disappears within seconds. But where do they go? More on that in a moment. Here's a bit of history and outline of the meteoric adoption and use of this application.

Snapchat was created by four Stanford students and was launched in September 2011. TechCrunch stated that last May 2012, only 25 images were being sent per second. However, by the end of November 2012, users had shared over one billion photos, with 20 million photos being shared per day. Yup, that's billion with a “b”.
 
So, how does it work? You take a picture or create a video on a mobile device, select one or more people from your contact list, determine the length of time it will be visible, and hit send. The recipient receives a message that they have been sent a "snap". In an attempt to provide some sort of protection from copying the image, the sender receives notification that a screenshot was taken. That's great, but nothing stops someone from using another device or camera to capture the image. Also, in January, a workaround was disclosed that would allow the image to be saved without being detected by Snapchat.

Once viewed, the photo or image is "deleted" from the device and Snapchat servers. Or is it? Maybe. This is from the company's Privacy Policy:

"When you send or receive messages using the Snapchat services, we temporarily process and store your images and videos in order to provide our services. Although we attempt to delete image data as soon as possible after the message is received and opened by the recipient (and after a certain period of time if they don't open the message), we cannot guarantee that the message contents will be deleted in every case."

Doesn't instill much confidence, does it?

Snapchat is available for Apple iOS and Android devices, and given that it's been downloaded millions of times, it's not that surprising that it currently sits at #16 on iTunes Top Free Apps Chart and #39 on Google play. The most current data available from Onavo Insights, a company that uses data to reflect true app market share, confirms that Snapchat is ranked #19 on the Onavo AppRank Top iPhone Apps at 11.6%. To put this into perspective, ubiquitous Facebook, ranked #1, has a market share of 72.5%. Another telling statistic comes courtesy of the Wall Street Journal's "Snapchat, an App Teens Can’t Put Down"; a recent study offered that approximately 13% of 13 to 18 year-olds use the app often. 

Speaking of Facebook, they too have entered this space with a revamped version of Poke. However, although functionally similar, Poke is not gaining nearly as much traction as Snapchat, it's not even in the Top 100 free apps on iTunes. This is likely due to Poke being tethered, unlike Snapchat - a standalone application, to one’s Facebook profile.

This is from the Apple AppStore Snapchat download page; make your own conclusion as to the principal use for Snapchat.

Snapchat, Inc.
Rated 12+ for the following:
Infrequent/Mild Sexual Content or Nudity
Infrequent/Mild Alcohol, Tobacco, or Drug Use or References
Infrequent/Mild Profanity or Crude Humor
Infrequent/Mild Mature/Suggestive Themes

Should this app be targeted at 12 year-old children? Giving young people a tool that enables them to share inappropriate content under a belief that the behavior could be safe, or at the very least, temporary, is irresponsible. At the end of the day, parents need to understand what it is their kids are up to, but also, children need to appreciate that whatever they send via the Internet is not confidential nor private and can potentially be available online forever.

Safe & Secure Volunteer Presentation Tips

Happy New Year to all. As promised in my Dec 21 blog, here are some tips that I would like to pass on, from my experience presenting to four different middle school groups in October last year, from grades 5 through 8.

Videos:

• Tailor your videos to the age group. The 5th grade group will relate much better to animation or more light hearted videos that still get the message acrosss, whereas 8th graders will relate better to more serious videos that relay messages in a more mature manner that does not make them feel that they are being approached as a younger child.
• Try to match the approximate age of the actors in the video to your audience's age group. This helps them to better relate to the material if they see the actors as peers in terms of age.
• Use a good amount of videos in your presentation, but keep them at a reasonable time limit (no more than 4-6 minutes), and always allow for discussion immediately after. Students at each grade, from 5 to 8, consistently wanted more and more videos. They related well to the videos and wanted to discuss them quite a bit. I was impressed with their attentiveness to the videos that I presented.
• Take the time to watch the videos yourself as you look around on YouTube. This was quite inspiring to me, and some were very moving, which motivated me even more on the topics I spoke of.
• Try to stay with videos that ISC2 has endorsed, or that Childnet International have endorsed. This is just a good pratice to ensure video quality and appropriateness.
• If you question anything in a video, look for a suitable replacement, or allow the school principal to view the video before you present, just to be safe.

Encouraging Participation:

• Ask the school if it is permissable to hand out candy or small trinkets to the students, in addition to the wristbands that ISC2 provides. This was a huge success for my groups in October due to the Halloween holiday being right around the corner. Ask the school for permission first, though. I also used plain rubber band bracelets.
• Ask the principal or a teacher to provide you with a volunteer or two, to help you hand out candy and bracelets when a student answers a question or provides some feedback. This will help you with time, and encourages the students even more. I would suggest letting the principal or teacher choose the volunteers. They will know who the best helpers are.
• Try to be random as you call on students that raise their hand. Scan the room and try to move from one side to the other to avoid focusing on one part of the room. This way the students feel they have a chance at being called upon, and they will keep trying to participate.
• As students provide feedback or ask/answer questions, always take their statement as being something valuable. Even if it is simple or a repeat that someone has else already said, the idea is to reinforce their comments as being valued. This will encourage them even more if they feel you care about what they have to say.
• Sometimes a student will get embarassed and forget what they wanted to say or clam up. Just ask them another simple question quickly if this happens, to ease their fear of speaking.
• If others laugh or tease a student for speaking, try to deter this behavior and redirect the conversation so that all students are forced to engage on the topic. You want to use this as a way of deterring a form of bullying right there on the spot.

Overall Tips:

• Dress professionally but comfortably.
• Be upbeat and excited about your topics.
• Test the audiovisual equipment ahead of time. You never know how your presentation will look on screen. Test sound as well.
• If possible, make an appointment with the principal before you present. Use this as a time to ask what problems they see the most at their school, or what they would like you to focus the most on. This can really be beneficial. Ask about this per age group as well. For example, at the school I presented at, the 8th grade was experiening much more cyberbullying issues than the 5th grade, so i was asked to focus more on cyberbullying for the 8th grade group.
• Speak clearly and move around. Make them feel like you are among the group rather than lecturing to the group.
• Bring water. If you are not used to presenting to large groups, you may be suprised at how quickly your throat will dry.
• Use humor. Use references to movies or characters the age group can recognize and relate to. You have to make them feel like you "get" them and understand who they are.
• At the end, you may have students approach you to tell a story or ask a question that they didn't want to voice during the presentation. Listen attentively and make them feel they have your attention. Time will be limited most likely, so try to take in as much as you can and provide feedback.

I hope this helps you as you go out to the schools and present this important material, for this great cause that is becoming more prevalent everyday!

Kim LaPole

Safe & Secure Online Volunteer Experience

It was a typical work day for me, chaotic and intense, as we all have experienced in the information
systems security field, as we go to our offices each day and perform our duties as information security professionals. The job can be very rewarding when you prevent a breach, catch an intruder on your company’s network, or have an incident that you quickly contained and prevented further data loss and exploitation to your company.  I truly love what I do, especially the fact that I work in a position where I protect the national security of this wonderful country we live in. Ultimately, at the end of my work day, I know my efforts go toward protecting the war fighter that defends our freedom and liberty every day.

On this day, I was checking my personal email at lunch, nothing out of the ordinary for me to do, and I noticed some emails from ISC². I had been thinking of the fact that I needed to check on my CPEs for my CISSP certification, so I decided to take a look at these emails to see if there were any new CPE opportunities. One email in particular caught my eye. It was a call for volunteers in my state, to sign up for the Safe & Secure Online program. I had not heard of this program, so I went out to the ISC²
website mentioned in the email to check it out. I have a younger sister, who is now 19, and I have watched her grow up with the Internet through her teenage years. Being that I am in the information systems field, I have always been called upon to fix her computer, answer questions, and provide guidance as she explored the World Wide Web. Along the way, I did my best to educate her of
online dangers, the importance of privacy of personal information, and the repercussions of what can result if caution is not exercised. I feel that my guidance was beneficial to her, but I am also aware of the power of manipulation of those who prey on children and young adults, the strong influence of peer pressure, as well as the desire to be accepted by others, especially those in one’s relative age group.

After reading about the program, I felt very compelled to participate. Speaking to children on this very important topic definitely seemed worthy of my time and efforts. I proceeded to sign up for the program and for my first school presentation. Before I even conducted my first presentation, I signed up for a second one. I had been preparing for the first, and the videos and presentation material were very powerful to me and created a strong drive inside of me to make a difference and really put a lot of work into the presentations. Over the course of that week, I ended up doing 4 presentations total. A fellow presenter needed coverage due to a work emergency, and I was more than happy to take on two more presentations. I am writing this blog because I want to share my experience and encourage others to get involved. The experience was very rewarding, and covering 4 different grades (5 through 8), in each of the 4 presentations, was truly an eye opener. The value of being able to educate those who are so susceptible to online dangers, but who are also very eager to learn to do the right thing, is something that I would encourage anyone to engage in.

From one presentation to the next, the experience varied in some ways but was also consistent in others.  The children love to answer questions and share stories. Let their voices be heard. You will be surprised at some of the questions they may ask you. This is good, though, because what better way to make an impression, than by having a child ask you a question in front of their entire class. For example, I had a student ask me if it was okay to playfully call his friend names online, as long as his friend was okay with it. Their questions are very straightforward and honest, especially the younger students, and they are really looking at you as an expert. This is a great feeling. Another example was a student asking me if they could talk to strangers online, even if they never agreed to meet the person face to face. Imagine the amount of influence you can have just by a student in the room of 120 other children, asking you a question such as this. My point here is that you can really feel the opportunity to guide a child down the right path in life just by giving them the chance to ask you a question. And, think of how many others in the room who were too shy to ask, but benefit from their question and your answer nonetheless. It is truly an amazing feeling. As the age group becomes older, you may get fewer questions, but more stories of situations they have been in and want to share. This is great too. Sometimes I have found that they do not want to ask a question, but instead tell a story (even if they suggest it is about someone other than themselves) in order to solicit your response. Be mindful of this, and always give some feedback and direction.

Another experience I had several times among my groups of children, was that some students will be struggling with something such as cyberbullying, and want to ask for help, but do not want to expose themselves. Many times they will be the child in the audience that raises their hand multiple times and asks the same question more than once, but in different ways. This is where you really have to be on your toes. Recognize it, and do not single them out or ask them anything direct, but provide them with the best guidance possible. Take the attention away from them directly and engage the crowd for suggestions. This will make them feel more comfortable and allow you to guide them at the same time. One example of this was a young girl who raised her hand at least 3 times, speaking in a hypothetical sense, but asking who “someone” could turn to if they needed to make cyberbullying stop. Another time she asked how to make it stop for her “friend.” And yet another time, she asked
who someone could go to if they do not want to tell their teacher or parents. It seemed to me like a cry for help, and I learned quickly to keep her engaged in the conversation and get her the information that she was seeking, without drawing too much attention to her. Again, the opportunity to be able to guide a young life like this was powerful.

One final example that I want to share is in regard to cyberbullying. This is a topic that strikes me deeply. It always bothered me to see anyone be bullied, ever since I was a child myself. It has happened to me, and I’ve seen it happen to many others, but I vowed to always step in when I saw it take place and do the right thing. This brings me to an experience that was very touching and I will never forget. I was presenting to an 8^th grade class, and at the end of the presentation, a few students came to me to share stories and ask questions. In the midst of that, a young man came to me and told me he could really relate to a youtube video I had shown of a boy his age who committed suicide due to cyberbullying.  This of course caught my attention and I spoke with him for a few moments. He informed me that he once was where the young man in the video was emotionally and mentally, but decided to seek help from his mom and then his pastor, and wanted to let me know that he was glad he chose that path of seeking help. He said he was glad that he didn’t go through with suicide which would cause pain to his family and friends, as he saw in the video. And he stated he was much healthier and happier now and that he would never consider that permanent option to cyberbullying, again. I cannot begin to tell you how this affected me in that moment. I thanked him for sharing his story, told him how brave he was for asking for help, and asked him if he had ever seen someone else be bullied like was. He said he had, and I asked him to please use that courage and experience to help someone else so that they too can have a chance to see that things really do get better, and that there is always hope and someone to help. He looked me right in the eyes and grinned proudly, and said he promised he would. That moment alone was worth every minute of time that I put into this program.

I plan to take part in more presentations soon, and encourage anyone out there to join in and make a difference to this very important cause.  Even if your time is limited, and you can only do a presentation once in a while, it will be well worth your time. Just think, you could direct the course of a young person who sees you as the wise one that they look up to, and that short period of time that you spend with them, could guide them on the path to a bright future. And, there are many
other students that you may never speak to in the audience, but who gain powerful advice from the hour or so that you spend educating them and showing them how to be safe and do the right thing.

In my next blog, I will share helpful tips and ideas on presenting to the children (broken down by age group), and also some suggestions on capturing their attention and generating participation. Until
then, sign up for a presentation and use your ability and knowledge to make a difference!!

Password Practice: With Age Comes Wisdom?

My friend and colleague Stephen Cobb has shared some interesting survey data in a blog article indicating that the age group between 18 and 34 is less likely than older groups to use complex passwords or even to use different passwords according to the sensitivity of the context. Kevin Townsend had his own take on the article, and in fact we talked subsequently about his suggestions that:

1. More mature people have had more negative experiences in life which make them more cautious/security conscious 
2. People with more to lose will make more effort to protect what they've got.

I agree that more mature people have had more negative experiences in life, and while it may or may not directly equip them with the best conceptual tools for being safe(r) on the Internet, it's likely to make them less likely to take things at face value.

I often say that part of my job (or at least what I think of as my job) is to encourage people to be sceptical. When my job involved more direct engagement with end users in support and training contexts, I found that people who'd been around the block a time or two were generally more receptive to advice and likelier to act upon it.

Of course, that was in a work context, and you could argue that I might have been seen as representing authority, but in fact even people who normally considered me very much as a hewer of wood and drawer of water rather than as an authority to be reckoned with were likelier to seek and follow security advice than more general advice. To be honest, the higher individuals perceive themselves as being in the hierarchy, the likelier they are to complain about inconvenient restrictions, but that will be tempered by the fact that they're aware of their own responsibilities, in particular for ensuring the safety of their data (and, no doubt, their jobs).

Outside the workplace, it can be very different, though not necessarily for more mature people: this group may have been conditioned by life and work experience to behave somewhat similarly at home as in the workplace. If they've learned to be concerned about security and respect the advice of others, they're likely to carry over that behaviour to their home life. (Though that in itself might be problematical, as there is so much bad or mixed advice available.)

The young are, perhaps, more vulnerable because, as the generation that is most likely to have grown up with information technology, they tend to overestimate their own understanding of it. And indeed, older generations - using the term generation in a very imprecise sense - tend to make similar assumptions. However, familiarity with interfaces is a lot different to understanding the underlying technology. (I'm reminded of an old science fiction story where someone from the future discovered that unlike Twain's hero in the Court of King Arthur, he was unable to capitalize on his knowledge of what technology would be available in his own time because he didn't really understand the processes behind the interface.)

People with more experience of life are more likely to see how a technology can be misused without fully understanding the technology, by extrapolating from off-line experience. They may certainly have more to lose, but more to the point, will also value what they have more, because it's likely that they'll have put more of their own effort into acquiring it, rather than simply having been given it. They're also likelier to be more aware that they don't have a whole lifetime in which to make up their losses. There’s certainly plenty to indicate that they don’t see their personal data as particularly sensitive, and certainly don't necessarily think ahead to what their Facebook Timeline will look like to a prospective employer, let alone to posterity.

However, they're also more vulnerable in that they will see the online world of social media in which they spend so much of their time as 'their' world - the natural environment of switched-on youth - rather than the habitat of a whole range of human beings, including some very unpleasant people indeed.

What really interests me about these data is that they have very little to do with technical knowledge - most people don't have a deep understanding of computer science and IT security (let alone the elements of cryptography), or even the ergonomic and psychosocial aspects of the interaction between human and computer. As it happens, the behaviour patterns that drive people to make certain password/passphrase/PIN choices - especially the stereotypical choices that are so helpful to an attacker - are a topic I find particularly interesting. But then these data aren't so much about self-knowledge as received wisdom.

David Harley CITP FBCS CISSP
ESET Senior Research Fellow

Responsible Digital Citizenship – A Year-Round, Lifelong Pursuit

With (ISC)² being a supporter of U.S. National Cyber Security Awareness Month every year since its inception, it strikes me that many more organizations are getting involved this year – maybe more than ever before. I asked myself what’s changed. Then, I realized I don’t care – I’m just glad that our society is shining a spotlight on helping vulnerable groups – especially children – understand the lasting consequences of their actions online – for themselves and for other people.

As recent as last week, we were told of the heartbreaking suicide of a young girl in British Columbia as a result of relentless taunting by her peers over a long period of time. Much of this bullying took place online. I could hardly read the story. Unfortunately, she’s not alone. There are countless, horrific examples of kids taking extreme actions because they feel ostracized and victimized and believe that they have nowhere to turn.

October is also National Bullying Prevention Month. Bullying has been around for a long time. Today, the vehicles to carry it out are just different. What scares me is that the Internet and mobile devices make it so easy to bully anonymously and to gang up on one child that it is almost becoming socially acceptable. In my day, it was easier to pick out who the cowards were because they couldn’t hide behind a computer. It was easier to stand up to them, too.

As a parent and grandfather, I’m encouraged to see law enforcement agencies, state and federal governments and companies pull together during National Cyber Security Awareness Month to do our most basic civic duty – create responsible digital citizens. It is up to us to empower children and their educators and caregivers to be aware of the consequences of bullying and to speak out against it so it becomes embarrassing and socially UNACCEPTABLE.

I would also like to see us make the pursuit of responsible digital citizenship year-round and lifelong. It’s up to us to guide our children so that when they’re faced with obvious or hidden dangers, they make the right choices. The Month is a good start. Now let’s keep it going EVERY month…

I want to extend a hearty thank you to the hundreds of (ISC)² Safe and Secure Online volunteers around the world who are sharing their time and expertise with children and educators during NCSAM and every month. Thank you for having a positive impact on children’s online choices and behavior. YOU ARE MAKING A TRUE DIFFERENCE! If you haven’t already signed up, join today. You won’t regret the time you spend in classrooms and the looks you see on the kids’ faces as they discuss what they see and do online. Schools can request a free presentation anytime. Go to www.isc2cares.org to find out how.

Don’t Forget About ID Thieves and Online Predators during NCSA Month: 5 Tips for Protecting and Educating Your Children

With National Cyber Security Awareness Month in full stride, parents are realizing the vulnerability of their children and the necessity for cyber safety education. Although numerous types of cybercrime are being discussed this month, I’d like to examine two areas that have an increasing incidence rate and lack of parent awareness: child identity theft and the prevalence of online predators.  

 

While malware, phishing and hacking are key buzz words in today’s headlines, identity theft should be top-of-mind, given its swift and detrimental repercussions. Once a child’s identity is stolen, it often takes less than 24 hours for changes to be made and credit cards opened. With such a small window between safety and insurmountable debt, prevention and awareness remain the key tools in protecting a child’s financial future. In order to adequately protect your child, parents should follow these three steps:

 

1. Find out who has access to your child’s information and how the information is stored. Always ask if a Social Security Number (SSN) is absolutely necessary before giving it out. And remember that you, as a parent, also store your child’s SSN, so if your computer is hacked, it may be your child’s identity information that is stolen and used to open credit cards, make purchases and ruin your child’s credit rating. Place a credit alert on your child’s SSN as well as your own.

 

2. Read all school materials sent home with your child, mail that comes to your home in your child’s name and e-mails asking for personal information. Keep an eye out for terms and conditions that mention “personally identifiable information,” and “opt out.” Make sure to find out how your child’s personal information will be used, whether it will be shared, and with whom, before you grant access. Be on the lookout for credit card offers for your children as well – this could indicate that an ID thief has established credit in your child’s name already.

 

3. Don’t carry around your child’s Social Security card (or your own) unless it is absolutely necessary. Carrying this information puts it at a higher risk for being physically stolen. Many criminals will hack into computers for information but by giving them a way to physically steal it, you make their job much easier.

 

Another major threat to kids today comes from online predators. Many of us have seen the television shows around online sexual predators and unfortunately clump all types of “online predators” into that category. Online predators can range from identity thieves to criminals focused on stealing your children’s most personal information. It is crucial that parents clearly understand these differences and follow these two over-arching tips:    

 

4. Be aware of all the numerous ways children can connect to the Internet: With modern technology, young people can connect from virtually anywhere. Phones, tablets, gaming systems and even televisions have become Internet-connected. Take inventory of all the devices your children are using and be sure they know how to use them safely and responsibly. If they don’t, request that an (ISC)²-certified cyber security expert come to your child’s school. Through Safe and Secure Online, these volunteers teach children for free how to protect themselves online. Also, be sure to turn on the parental controls whenever possible.

 

5. Talk to other parents: When and how you decide to let your children use the Internet is a personal parenting decision. Knowing what other parents are thinking and allowing their children to do is important and can be helpful for making decisions about what boundaries you feel comfortable establishing for what your children do online.

 

Cyber security awareness is fundamental to our children’s education and should be a lifelong, year-round pursuit. National Cyber Security Awareness Month is an exceptional campaign that’s taking nationwide cyber awareness to the next level. For more information on how we can work together to protect our children, please visit www.isc2cares.org to learn more about Safe and Secure Online, the (ISC)² Foundation program that aims to protect children’s cyber lives through education and awareness.

Practice Safe Computing

by F. Gary Alu

What is the first thing we should check when we turn on our computer? That’s a question I always pose to the kids when I present the (ISC)2 Safe and Secure Online Program.  If your answer is Facebook or Email, you have a problem.  Of course having a look at your anti-virus application is the place to start.  Is it running?  Are the databases current? (by current I mean no older than 24 hours).  Even the best anti-virus (AV) solution will do one little good if it is not running because the subscription has expired or if the databases are days or even weeks old.

There is really no good excuse for not having a good anti-virus and anti-malware application installed and running on your computer.   Nearly every major vendor has a free version, not to be confused with a “trial version”.  The trial version permits full-unlicensed use for a brief period, typically 30 days, at the end of which the user is required to purchase the licensed version.  I point this out because I can’t tell you how many times I have come across users who did not really understand that the trail version actually quits working. There are several free solutions available today, Microsoft Security Essentials for the Windows platform comes to mind.  In my neck of the woods, Cox provides free McAfee to its subscribers.

Hold up! Still not time to dive into our e-mail.  After we have verified our AV system is working we need to check for updates to our operating system and installed applications.  The immediate application of security updates is very important!  Always make certain you have a good backup before you apply any patch or install any new software.  Understand that security updates for our applications are just as important as the security updates for our operating systems.  This includes not only our productivity suites, e.g. word processing, spreadsheets, etc., but other applications we tend to take for granted, such as Adobe Flash and Adobe Reader (PDF files).  These should all be set to automatically download updates when they are available and prompt us to install.

Good to go?  Well almost.  We are now confident that our desktop and applications are safe and happy we must deal with what’s behind door number one, the Internet.  A click of the mouse and we have the whole world at our fingertips.  We need to wonder, does the whole world now have us at their fingertips as well?

Let’s start with our connection to the Internet.  I must say that the cable providers have really come a long way from the days where we paid for service and they dropped in a digital subscriber line (DSL) or cable modem and told us to “plug your computer here”.  They learned hard lessons from exploits like the Melissa macro virus of the 90’s or the Slammer Worm in 2003.  Critters like these cause significant disruption for users and the Internet service providers (ISP).  The sales people are now much more knowledgeable and aware.  They ask the right questions, such as “do you have a DSL/Cable Router”? If you do not have one they offer to sell you one or they recommend one and where to buy one.  The router connects directly to the cable modem and not our computer.  We connect to the router, either via WiFi or Ethernet cable.  This router is also our “Firewall” and it hides our private systems and keeps the “Internet fingertips” out of our stuff.

 Nearly there!  I would be remiss if I did not mention online shopping.  I am writing this article two weeks before Christmas and eCommerce is in full swing.  It is easy, convenient, and definitely saves us money.  There are, however, some serious pitfalls and we need to understand and be aware so we do not fall victim to social engineering exploits like phishing, virus hoaxes and other confidence games that are always present on the Internet.    We are going to shop, that’s a given, so how do we protect our identity and our money?  My best advice for a first step is work with your bank.  When an identity is stolen or a debit or credit card is compromised the banks suffer losses and they don’t like it either.

I never use a debit card, as a debit card, to make a purchase anywhere, online or in person.  Always run it as a credit card!  My bank recommended we setup a separate account to be used only for online purchases.  I move money into this account when I need it, i.e. replenish my Starbucks card; make a purchase from Amazon, etc.  If my account is compromised am an only at risk of losing the small amount in that account and not my entire checking account.  There are of course requirements and agreements between my bank and myself and these will differ from bank to bank.   This does limit the liability for both of us so it is a win-win all around.

If you would like to view more information about securing Facebook or protecting your computer system, please visit http://cyberexchange.isc2.org/safe-secure.aspx