Home > Ask the Security Experts > Security Management Questions & Answers > What is the best way to administer exams to students via computer?
Ask The Security Expert: Questions & Answers
EMAIL THIS

What is the best way to administer exams to students via computer?

Mike Rothman EXPERT RESPONSE FROM: Mike Rothman

Pose a Question
Other Security Categories
Meet all Security Experts
Become an Expert for this site


Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us   


>
QUESTION POSED ON: 09 January 2008
I work for a university that is considering having students take examinations on computers. One option is to have lecturers create exams as Microsoft Word files that are uploaded to an HTTPS server and then downloaded in public computer labs, where the students take the exams. Completed exams are uploaded to the HTTPS server. The other option is to have lecturers convert exams to PDF files and upload them to the HTTPS site; the PDFs are downloaded and printed out and students do their exams by hand. Completed exams are scanned and uploaded back to the HTTPS site. It seems obvious to me that excluding the labs from the process would reduce risk considerably. What's your view?

>
EXPERT RESPONSE
The first issue that jumps out at me is authentication. It's not clear from your brief description how you plan to make sure that the right student is actually the one submitting the document. In the case of the Word file, there is really no way to enforce that, unless some kind of digital signature system is enforced to "sign" the paper as it's submitted.

The case of the uploaded PDFs provides a bit more integrity in the system because handwriting can be verified. I would suggest taking a step back and finding out what the business need is for the students to submit the tests online. Is this a distance learning environment? Is there an issue with using paper? I guess I'm dating myself, but the processes as described seems to be a solution looking for a problem, which isn't clear from your question.

There are many educational learning systems available today that would allow students to take tests online. Filling out questions, either multiple choice or essay and having the data deposited into a database for grading, etc., would be a better option than the kluge that you described.

In terms of the public computer labs, I'm not sure how you would restrict access. In a university setting, students need to be able to access the systems from anywhere on campus. Are you suggesting that they can only take the tests, or upload the files from a central place? Again, that would seem to defeat the purpose of the automation in the first place.

That's why I'll go back to the first statement I made about authentication. If you have the proper way to verify identity, then where the students access the system or upload files doesn't really matter.

For more information:

  • In this tip, Noah Schiffman discusses the positive and negative aspects of both IP-based and signature-based email authentication.
  • Joel Dubin explains why identity-enabled network devices offer an extra layer of authentication.


  • Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us   


    RELATED CONTENT
    Security Management
    What is the GISP certification and how does it compare to the CISSP certification?
    Would QSAs normally write up a PCI DSS report on compliance (ROC) and submit it to all issuing card brands?
    How can gap analysis be applied to the security system development life cycle?
    When should an enterprise consider low-cost security appliances vs. a bigger do-everything appliance?
    What are some tips on protecting my security budget in a tight economy?
    What value do research firms provide to enterprises that subscribe to their services?
    What certificate offers the best ROI for an IT project manager?
    Which is the biggest threat to data: Insider activity or outsider activity?
    What role does information security play in enterprise fraud-prevention activities?
    What is the difference between an SAS 70 data center and a Tier III data center?

    Two-Factor and Multifactor Authentication Strategy
    PKI and digital certificates: Security, authentication and implementation
    Security token and smart card authentication
    Enterprise single sign-on: Easing the authentication process
    Exploring authentication methods: How to develop secure systems
    What should an enterprise look for in a password token, and in a vendor?
    If the encryption on the Mifare Classic RFID has been cracked, are smart cards insecure?
    How do RFID-blocking passport wallets work?
    What are good features to look for when searching for new access control software?
    Quiz: The new school of enterprise authentication
    The steps of privileged account management implementation

    PKI and Digital Certificates
    PKI and digital certificates: Security, authentication and implementation
    Should computer exams be transmitted as PDF files or Word files?
    Should PKI systems be used for laptop encryption?
    Email authentication showdown: IP-based vs. signature-based
    VeriSign to shed businesses, return to security roots
    How do anonymous credentials and selective disclosure certificates affect enterprise IAM?
    Choosing from the top PKI products and vendors
    Can the symmetric encryption algorithm for S/MIME messages be changed?
    Securing VoIP Networks: Threats, Vulnerabilities and Countermeasures
    Creating a personal digital certificate
    PKI and Digital Certificates Research

    RELATED GLOSSARY TERMS
    Terms from Whatis.com − the technology online dictionary
    AAA server  (SearchSecurity.com)
    authentication  (SearchSecurity.com)
    authentication, authorization, and accounting  (SearchSecurity.com)
    federated identity management  (SearchSecurity.com)
    Kerberos  (SearchSecurity.com)
    password hardening  (SearchSecurity.com)
    typeprint analysis  (SearchSecurity.com)

    RELATED RESOURCES
    2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems
    Search Bitpipe.com for the latest white papers and business webcasts
    Whatis.com, the online computer dictionary



    Search and Browse the Expert Answer Center
    Search and browse more than 25,000 question and answer pairs from more than 250 TechTarget industry experts.
    Browse our Expert Advice



    Find Security Solutions for Your Business
    Targeted Security Channel Tips for Resellers, Integrators and Consultants
    TechTarget Security Media
    Information Security View this month\\'s issue and subscribe today.
    Information Security Decisions Apply online for free conference admission.
    SearchSecurity.com
    HomeNewsMagazineMultimediaWhite PapersLearningAdviceTopicsEventsAbout Us

    About Us  |  Contact Us  |  For Advertisers  |  For Business Partners  |  Site Index  |  RSS
    TechTarget provides enterprise IT professionals with the information they need to perform their jobs - from developing strategy, to making cost-effective IT purchase decisions and managing their organizations' IT projects - with its network of technology-specific Web sites, events and magazines.

    TechTarget Corporate Web Site  |  Media Kits  |  Reprints  |  Site Map




    All Rights Reserved, Copyright 2003 - 2008, TechTarget | Read our Privacy Policy
      TechTarget - The IT Media ROI Experts