Home > Ask the Security Experts > Security Management Questions & Answers > What is the best way to administer exams to students via computer?
Ask The Security Expert: Questions & Answers
EMAIL THIS

What is the best way to administer exams to students via computer?

Mike Rothman EXPERT RESPONSE FROM: Mike Rothman

Pose a Question
Other Security Categories
Meet all Security Experts
Become an Expert for this site


Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us   


>
QUESTION POSED ON: 09 January 2008
I work for a university that is considering having students take examinations on computers. One option is to have lecturers create exams as Microsoft Word files that are uploaded to an HTTPS server and then downloaded in public computer labs, where the students take the exams. Completed exams are uploaded to the HTTPS server. The other option is to have lecturers convert exams to PDF files and upload them to the HTTPS site; the PDFs are downloaded and printed out and students do their exams by hand. Completed exams are scanned and uploaded back to the HTTPS site. It seems obvious to me that excluding the labs from the process would reduce risk considerably. What's your view?

>
EXPERT RESPONSE
The first issue that jumps out at me is authentication. It's not clear from your brief description how you plan to make sure that the right student is actually the one submitting the document. In the case of the Word file, there is really no way to enforce that, unless some kind of digital signature system is enforced to "sign" the paper as it's submitted.

The case of the uploaded PDFs provides a bit more integrity in the system because handwriting can be verified. I would suggest taking a step back and finding out what the business need is for the students to submit the tests online. Is this a distance learning environment? Is there an issue with using paper? I guess I'm dating myself, but the processes as described seems to be a solution looking for a problem, which isn't clear from your question.

There are many educational learning systems available today that would allow students to take tests online. Filling out questions, either multiple choice or essay and having the data deposited into a database for grading, etc., would be a better option than the kluge that you described.

In terms of the public computer labs, I'm not sure how you would restrict access. In a university setting, students need to be able to access the systems from anywhere on campus. Are you suggesting that they can only take the tests, or upload the files from a central place? Again, that would seem to defeat the purpose of the automation in the first place.

That's why I'll go back to the first statement I made about authentication. If you have the proper way to verify identity, then where the students access the system or upload files doesn't really matter.

For more information:

  • In this tip, Noah Schiffman discusses the positive and negative aspects of both IP-based and signature-based email authentication.
  • Joel Dubin explains why identity-enabled network devices offer an extra layer of authentication.


  • Sound Off! -   Be the first to post a message to Sound Off!


    Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us   


    RELATED CONTENT
    Security Management
    Is it against HIPAA regulations to permanently store sensitive information?
    Two-tier distributed systems vs. three-tier distributed systems
    How to prevent software piracy
    How do ISO 17799 and SAS 70 differ?
    Has FFIEC made any VoIP-specific mandates?
    Should computer exams be transmitted as PDF files or Word files?
    Is it against HIPAA regulations to display client names?
    Getting started on a career in penetration testing
    Are there security management products that can track compliance objectives?
    What Web security initiatives can be taken on a college campus?

    Two-Factor and Multifactor Authentication Strategy
    Keystroke recognition aids online authentication at credit union
    Fraudsters exploiting multiple financial services channels
    Video: Changes ahead for MIT Kerberos Consortium
    Kerberos security evolves for B2B, mobile tech
    Kerberos: Authentication with some drawbacks
    Worst practices: Exposing IAM blunders
    How secure is online banking today?
    Security360: Identity management market
    Enterprise security in 2008: Assessing access management
    IBM releases simplified Tivoli Identity Manager

    PKI and Digital Certificates
    Should computer exams be transmitted as PDF files or Word files?
    Should PKI systems be used for laptop encryption?
    Email authentication showdown: IP-based vs. signature-based
    VeriSign to shed businesses, return to security roots
    How do anonymous credentials and selective disclosure certificates affect enterprise IAM?
    Choosing from the top PKI products and vendors
    Can the symmetric encryption algorithm for S/MIME messages be changed?
    Securing VoIP Networks: Threats, Vulnerabilities and Countermeasures
    Creating a personal digital certificate
    What are the alternatives to RC4 and symmetric cryptography systems?
    PKI and Digital Certificates Research

    RELATED GLOSSARY TERMS
    Terms from Whatis.com − the technology online dictionary
    AAA server  (SearchSecurity.com)
    authentication  (SearchSecurity.com)
    authentication, authorization, and accounting  (SearchSecurity.com)
    federated identity management  (SearchSecurity.com)
    Kerberos  (SearchSecurity.com)
    typeprint analysis  (SearchSecurity.com)

    RELATED RESOURCES
    2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems
    Search Bitpipe.com for the latest white papers and business webcasts
    Whatis.com, the online computer dictionary



    Search and Browse the Expert Answer Center
    Search and browse more than 25,000 question and answer pairs from more than 250 TechTarget industry experts.
    Browse our Expert Advice

    TechTarget Security Media
    Information Security View this month\\'s issue and subscribe today.
    Information Security Decisions Apply online for free conference admission.
    SearchSecurity.com
    HomeNewsMagazineWebcastsWhite PapersLearningAdviceTopicsEventsAbout Us

    About Us  |  Contact Us  |  For Advertisers  |  For Business Partners  |  Site Index  |  RSS
    TechTarget provides enterprise IT professionals with the information they need to perform their jobs - from developing strategy, to making cost-effective IT purchase decisions and managing their organizations' IT projects - with its network of technology-specific Web sites, events and magazines.

    TechTarget Corporate Web Site  |  Media Kits  |  Reprints  |  Site Map




    All Rights Reserved, Copyright 2003 - 2008, TechTarget | Read our Privacy Policy
      TechTarget - The IT Media ROI Experts