# Presentation: 892086

## Session # T- 7

**Web 2.0 Technologies and Privacy/Security Considerations**
**Sandy England & Joseph Salama**

## Agenda

- Web 2.0 technologies
- Opportunities and Challenges
- Policy/Legal/ Privacy/Security Issues
- Privacy Act
- E-Government Act & FISMA
- Web 2.0 Potential Issues and Concerns
- Conclusion

- Source: http://dccblawg.blogspot.com/2007/11/legal-implications-of-web-20.html

## Introduction

**Introduction**

- Our targeted users are attracted to social networking communities that foster user-driven content
- How can we leverage social networking to extend our reach and message?
- Web 2.0 brings a new set of challenges - privacy, data security, and legal issues

- Source: http://www.cooltownstudios.com/images/web2.0.jpg

**Notes:**
Research proves that our targeted consumers are attracted to social networking communities that foster user-driven content
How should we use social networking and Web 2.0 emerging technologies to attract and engage our students, parents, and schools?
In many cases, obstacles to adoption of such user-driven content include numerous privacy, data security, and legal issues
A number of agencies, including the Department of Education, are beginning to leverage social networking to extend their reach and message to constituents

## What is Web 2.0?

**What is Web 2.0?**

- From Wikipedia:
- Web 2.0 is a living term describing changing trends in the use of World Wide Web technology and web design that aims to enhance creativity, information sharing, collaboration, and functionality of the web
- Web 2.0 concepts have led to the development and evolution of web-based communities and hosted services, such as social-networking sites, video sharing sites, wikis, blogs, and folksonomies

- http://en.wikipedia.org/wiki/Web_2.0

**Notes:**
The web is used as a social platform
Users are producers and consumers at the same time, and are socially related to share and create knowledge
This social aspect is defined by Gartner as “consumerization” and focuses on the ongoing trend of new technologies and models appearing in the consumer world before evolving into enterprises
Adds a new layer of information interactivity based on tagging, social networks, and user-created taxonomies (often called “folksonomies”)

## What is Web 2.0?

**What is Web 2.0?**

- Community
- Users organize themselves and work in partnership with common goals
- Active participation
- Users move from passive role (reading) to active role (authoring)
- The Wisdom of Crowds:
- Individual users add *value*
- Aggregate data into a collective thought
- Applications get better/smarter the more people use them

## Web 2.0 By Example

**Web 2.0 By Example**

**Web 1.0 ******
- DoubleClick 
- Ofoto 
- Akamai 
- Britannica Online 
- Personal websites 
- Page views 
- Screen scraping 
- Publishing 
- Systems 
- Directories (taxonomy) 
- Stickiness 
- Domain name speculation 

**Web 2.0 **
- Google AdSense
- Flickr
- BitTorrent
- Wikipedia
- Blogging
- Cost per click
- Web services
- Participation
- Wikis
- Tagging ("folksonomy")
- Syndication
- Search engine optimization

- http://www.oreillynet.com/pub/a/oreilly/tim/news/2005/09/30/what-is-web-20.html

## Web 2.0 Technologies

**Notes:**
Shows the physical aspects of Web 2.0 and how they connect together, such as the people, visual front-end, Web services, and valuable content. 
The diagram also shows orthogonal, non-functional aspects such as customer self-service, user control, mass servicing of micromarkets, etc.Some things are notably missing from this view of Web 2.0. 
One of these is critically, enterprise-class security. 
Another is control over hosting models (behind the firewall appliance vs. external SaaS).

## Web 2.0 Components

- Source: http://www.personalizemedia.com/web-00-to-50-spheres-of-influence/

**Notes:**
The diagram above shows the components of web 2.0 with axes of:
synch/asynch on the horizontal
one to many and many to many on the vertical axis
All of the components can be delivered to the four screens indicated on the top left.
It is primarily intended to show that:
The blue (text/conversation) and purple (richer media) web 2.0 components are often combined to create a well rounded social network portal
The yellow blocks are messengers, digg and rss which act as glue and navigation

## Web 2.0 Framework

- Source: http://www.rossdawsonblog.com/weblog/archives/2007/05/

**Notes:**
Ross Dawson provides a clear, concise view of the nature of Web 2.0, particularly for senior executives or other non-technical people who are trying to grasp the scope of Web 2.0, and the implications and opportunities for their organizations. 
There are three key parts to the Web 2.0 Framework:
Web 2.0 is founded on seven key Characteristics: Participation, Standards, Decentralization, Openness, Modularity, User Control, and Identity.
Web 2.0 is expressed in two key Domains: the Open web, and the Enterprise.
The heart of Web 2.0 is how it converts Inputs (User Generated Content, Opinions, Applications), through a series of Mechanisms (Technologies, Recombination, Collaborative Filtering, Structures, Syndication) to Emergent Outcomes that are of value to the entire community.

## Web 2.0 Technologies

**Web 2.0 Technologies**

- User-Generated Content (e.g. FlickR and YouTube)
- Web Content Sharing (e.g. Digg)
- Social Bookmarking (e.g. Del.icio.us)
- Blogs
- Wikis
- AJAX
- Etc.

- Source: http://edtechtrek.blogspot.com/2008_03_01_archive.html

**Notes:**
User-Generated Content
Share user-generated photos and video online
A massive amount of media is generated and labeled by end-users
People can upload and share personal photos and videos
Organize media using collections, sets, and tags
Keep in touch with friends
Web Content Sharing
End-users look at information from a collective community point of view
Represents Web space where people can:
Jointly determine the value of content items
Interact with other people to discover, select and share new ones
Collaborative editorial process
End-users discuss news, videos, podcasts and any kind of information available online
Social Bookmarking
Collection of favorites that people have found
Each end-user keeps links, shares favorites and discovers new things
Uses tags to organize information (web pages, documents, videos and images online) in a flexible and personal way

## User-Generated Content

- Users upload and share personal videos (e.g. YouTube) and pictures (e.g. FlickR)
- Organize media through tagging of themes, channels, collections, sets, etc. and allow commenting
- How could we do it?
- Enable peer-to-peer mentoring and support
- Share tips, stories, how they overcame obstacles
- Their lessons become sources of inspiration and motivation for others

## Blogs

**Blogs**

- Publish articles and info about any subject
- Share information and discuss topics
- An effective communication tool
- Can be updated at virtually zero cost
- Organize content with meta-data, categorizations, and labels

**Notes:**
An effective communication tool for management to communicate with employees/constituents and provide updates

Under Secretary Sara Martinez Tucker started this blog to help uncover obstacles and solutions in getting to college. 
The blog facilitates a conversation with students “... so that together we can find ways to make college a possibility for all Americans.”

## Wikis

**Wikis**

- Speed and flexibility: Wiki means "fast" in Hawaiian
- Effective tool for collaborative authoring
- Allows users to create and edit pages
- Breaks away from structured hierarchies to share information
- The collective intelligence becomes a creative genius

**Notes:**
Ward Cunningham started developing WikiWikiWeb in 1994
Centralizes project ideas and improves communication

The Higher Education Summit Wiki encourages participants to collaborate in the creation of a National Action Plan.

## Web 2.0 Opportunities

**Web 2.0 Opportunities**

- Collaborate more easily:
- Internally (employees)
- Externally (partners and customers)
- Allow citizens to have greater input
- Enable citizens to help each other – peer to peer collaboration
- Create communities, which in turn create creative solutions to problems
- Aggregate constituent wisdom: “The whole is smarter than the one”

**Notes:**
Help agencies and employees to better collaborate
Collaborate with partners
Tap more easily and productively into knowledge in the field

## Web 2.0 Challenges

**Web 2.0 Challenges**

- Web 2.0 can enhance the delivery of public services and citizens’ engagements with government
- However, a number of challenges prevent us from diving head first into Web 2.0
- Privacy issues
- Control of Content
- Anonymous postings (yes or no?)
- User Trust - can change content of others
- Vandalism
- Plagiarism and Copyright infringement
- Balancing our role as responsible officials:
- To protect citizens in this online world
- To respect the First Amendment’s protection of free speech

## Web 2.0 Challenges (cont.)

*“**Protect government information commensurate with the risk and magnitude of harm that could result from the loss, misuse, or unauthorized access to or modification of such information... (consistent with)...the risk-based policy for cost-effective security established by the Computer Security Act of 1987.” *
*	**	**	**	**	**	**OMB Circular A-130*

## Privacy/Security Considerations

- Laws, mandates, policies, and processes that require agencies to protect the use of data collected from citizens
- Privacy Act
- System of Records
- Information Clearance
- E-Gov Act and FISMA
- Confidentiality, Integrity, and Availability of Information
- OMB Circular A-130, Appendix III
- 	... and many more ...

## Privacy Concerns

- A full 93% of children ages 12-17 are online!
- 55% of online teens use social networks
- 55% of teens have created an online profile
- 48% of teens visit social networking sites daily
- 22% visit several times a day
- 66% of teens with profiles say that their information is not visible to all Internet users

- Pew Internet &  American Life Project, “Parent and Teenager Internet Use” (Oct. 24, 2007)
- Pew Internet & American Life Project, “Teens, Privacy & Online Social Networks” (Apr. 18, 2007)
- Pew Internet & American Life Project, “Teens and Online Stranger Contact” (Oct. 14, 2007)

**Notes:**
People are posting much information about themselves and are at risk of being solicited by predators
The Pew survey attempts to examine teenagers’ attitudes and habits regarding social networking. The Pew Internet Project interviewed 935 teens age 12 to 17 from October to November 2006. It said the survey has a margin of error plus or minus 3 percentage points.
That has caused a range of action - Some schools have banned children’s use of MySpace; legislators have proposed new online rules for social networks; and worried parents have turned to software to monitor their child’s activities online. Sites such as MySpace also have taken it upon themselves to institute security measures to protect younger members.

The majority actively manage their profiles to keep sensitive information private, such as full name, home phone number or cell phone number

## Privacy Concerns (cont.)

- 63% of teens with profiles believe a motivated person could eventually identify them from the information they publicly provide on their profiles
- 7% of online teens say they have been contacted by a stranger – either through “friend” requests, spam email, or comments posted on a blogging or photo sharing site – who made them feel scared or uncomfortable

- Pew Internet &  American Life Project, “Parent and Teenager Internet Use” (Oct. 24, 2007)
- Pew Internet & American Life Project, “Teens, Privacy & Online Social Networks” (Apr. 18, 2007)
- Pew Internet & American Life Project, “Teens and Online Stranger Contact” (Oct. 14, 2007)

## Privacy Goals

- Guiding Policies and Processes
- System of Record Notification (SORN) Process
- Information Clearance (IC) Process
- Guiding Principles:
- Don’t collect PII data unless truly necessary
- Randomly generate IDs which can’t be mapped back to user names
- Ensure user account information is invisible
- Disallow lookups so strangers cannot iterate through IDs to see public information

**Notes:**
Most applications don’t need access to full user information

## Liability

- Liability laws addressing complex new divisions of responsibility in online relationships between government, businesses and citizens
- Is there liability for providing an application that enables stalking and other violations?
- Need comprehensive Terms & Conditions of Use
- Hide profile data by default
- Easy to use privacy settings

## Intellectual Property

- YouTube/Google facing legal action from Viacom for allowing copyrighted material to be uploaded to the video sharing site
- Universal initially attacked MySpace for illegal sharing of music before developing a branded virtual jukebox that users can post to their profile
- Signing off a blog post with image of your favorite cartoon character may infringe copyright laws
- Yet ... copyright law has faced these challenges since the beginning of the Internet

## Legislative and Policy Drivers

**Legislative and Policy Drivers**

- E-Government Act, Public Law 107-347 (Title III) Federal Information Security Management Act of 2002 (FISMA)
- OMB Circular A-130 (Appendix III) Management of Federal Automated Information Resources
- OMB Memorandum M-06-16 Protection of Sensitive Information

**Notes:**
The E-Government Act (Public Law 107-347)
Passed by the 107th Congress and signed into law by the President in December 2002 
Recognized the importance of information security to the economic and national security interests of the United States
Title III: Federal Information Security Management Act (FISMA)
Requires each federal agency to develop, document, and implement an agency-wide information security program to provide information security for the information and information systems that support the operations and assets of the agency, including those provided or managed by another agency, contractor, or other source.

## FISMA Requirements

**FISMA Requirements**

- FISMA directed that federal standards be created to address the specification of minimum security requirements for federal information and information systems by:
- Conducting security _***categorization***_ of the information and information systems based on risk levels
_***Authorization***_*** ****of**** ***system processing prior to operations and periodically thereafter

**Notes:**
FISMA directed the promulgation of federal standards to address the specification of minimum security requirements for federal information and information systems by conducting:
Conduct security categorization of the information and information systems based on risk levels
Authorize system processing prior to operations and periodically thereafter

## FISMA Requirements (cont.)

**FISMA Requirements (cont.)**

- All Federal agencies are responsible for ensuring appropriate security controls
- FISMA applies to information and information systems used by the agency, contractors, and other organizations and sources
- Require agencies to certify their systems to operate
- Security certification is the assessment of those security controls

**Notes:**
All Federal agencies are responsible for ensuring appropriate security controls
All agencies must develop policies for information security oversight of contractors and other users with privileged access to Federal data
Agencies must also review the security of all users with privileged access to Federal data and systems
FISMA applies to both information and information systems used by the agency, contractors, and other organizations and sources
Agency IT security programs apply to all organizations (sources) which possess or use Federal information or which operate, use, or have access to Federal information systems on behalf of a Federal agency
Such other organizations may include contractors, grantees, State and local governments, industry partners, etc.

## Security Accreditation

**Security Accreditation**

- Required by OMB Circular A-130, Appendix III, security *accreditation *provides a form of _quality control_
- Challenges Federal managers to implement the most effective security controls possible
- Is the official management decision given by a senior agency official to authorize operation
- The senior agency official is usually the highest level executive in each organization within the agency

**Notes:**
Required by OMB Circular A-130, Appendix III
Provides a form of quality control 
Challenges Federal managers and technical staffs to implement the most effective security controls possible in an information system, given mission requirements, technical constraints, operational constraints, and cost/schedule constraints
This official manager is usually the highest level executive in each organization within the Department. 

## Security Accreditation (cont.)

**Security Accreditation (cont.)**

- By *accrediting* an information system, an agency official _*explicitly accepts the risk*_ and responsibility for the security of the system
- The agency official is fully _*accountable*_* *for any adverse impacts to the agency if a breach of security occurs
- Thus, _*responsibility and accountability*_ are core principles that characterize security accreditation

**Notes:**
Is the official management decision given by a senior agency official to authorize operation of an information system and to explicitly accept the risk to agency operations, agency assets, or individuals based on the implementation of an agreed-upon set of security controls

## Official Information Dissemination

**Official Information Dissemination**

- All efforts to provide official government information to external stakeholders
- Includes various types of media, such as video, paper, web, etc. (NIST SP 800-60 rev2, section C.2.6.2)
- FISMA in a nutshell:
- Categorization
- Certification
- Accreditation
- Authorization

## Security Categorizations

- Security Objectives:
- Confidentiality
- Integrity
- Availability
- Impact levels:
- Low
- Moderate
- High

## Confidentiality

**Confidentiality**

- Information Dissemination Type for Confidentiality:
- The loss of confidentiality results in the unauthorized disclosure of information
- Recommended Confidentiality Impact Level for Web 2.0 Applications
- Low

**Notes:**
The effect of unauthorized disclosure of official information dissemination information on the ability of responsible agencies to provide official Federal government information to external stakeholders through the use of various communications media
Official information dissemination information is usually in the public domain and poses no confidentiality impact

## Integrity

**Integrity**

- Information Dissemination Type for Integrity:
- The loss of integrity results in the unauthorized modification or destruction of information (e.g., modified web pages, electronic mail, etc.)
- Recommended Integrity Impact Level for Web 2.0 Applications
- Low

## Availability

**Availability**

- Information Dissemination Type for Availability:
- The loss of availability results in the disruption of access to or use of  information or information system
- Recommended Availability Impact Level for Web 2.0 Applications
- Low

## Web 2.0 is NOT the Issue

**Web 2.0 is NOT the Issue**

*Adverse *Events can affect operations and/or public confidence in a Federal agency
- Security controls can be put into place to mitigate these risks
- Examples:
- Web filtering software for blocking malicious behaviors (e.g., scanning inbound content and inbound binary files)
- Strip / rewrite HTML and JavaScript code
- Lock down of browsers to disable scripting
- Implement virtualization
- Promote user awareness of Web-related risks
- Create and enforce acceptable use policies

## Concerns/Recommendations

- Content Control
- Requires trusting third parties with content
- Many uses of Web 2.0 may not make sense for agencies that interact directly with the public and wish to maintain tight control over content
- Personally Identifiable Information
- Discuss security, legal, and privacy concerns and determine strategy and approach
- Develop privacy & acceptable use policies/processes for the dissemination of official information type via Web 2.0
- Plan ahead for clearance process
- Develop policies for management of data

## Concerns/Recommendations

- Interlinked Platforms
- Difficult to remotely administer
- Less control of security
- May be affected by attacks aimed at other web sites or that are hosted by external provider
- Securing public web servers in accordance with NIST Special Publication 800-44 Version 2 cannot be imposed on interlinked computing platforms not owned by the Federal government
- Nearly impossible and/or cost prohibitive to “certify and accredit” interlinked computing platforms in accordance with FISMA

## Getting Started

- Educate the organization on Web 2.0
- How it can help the organization meet fast-evolving objectives?
- Align clear priorities for online collaboration with organizational objectives
- Initiate a pilot project
- Evaluate technology strategy and compatibility

- Source: William D. Eggers - Global Public Sector Research Director, Deloitte

**Notes:**
Educate the organization by helping staff at all levels understand what Web 2.0 applications are and how they can help the organization meet fast-evolving objectives
Develop a strategy by establishing clear priorities for online collaboration that align to organizational objectives
Initiate a pilot project by identifying a specific opportunity to drive early success – test the organization’s readiness to embrace the principles of online collaboration
Evaluate technology compatibility
Evaluate existing enterprise technologies to determine their compatibility with the evolving Web 2.0 strategyWeb 2.0 technology compatibility with existing infrastructure
Existing architecture compatibility with the evolving Web 2.0 strategy

## Getting Started (cont.)

- Create policies that maximize benefits of adopting Web 2.0 in organization
- Measure results by establishing key performance indicators that measure the strategy’s effectiveness
- Embrace a culture of collaboration and continually evolve how interaction happens with stakeholders inside and outside of government

- Source: William D. Eggers - Global Public Sector Research Director, Deloitte

**Notes:**
Create policies that maximize the benefits of adopting Web 2.0 within the organization
Measure the results by establishing key performance indicators that help measure the strategy’s effectiveness
Embrace a culture of collaboration by continually evolving how interaction happens with stakeholders inside and outside of government

## 

Questions?

**Questions?**

## Contact Information

**Contact Information**

- We appreciate your feedback and comments. We can be reached at:
- Joseph Salama,
- ED Chief Information Security Officer
- Phone: 202-245-6069
- Email: Joseph.Salama@ed.gov
- Sandy England,
- FSA Enterprise Portal Manager
- Phone: 202-377-3537
- Email: Sandy.England@ed.gov