Home > Ask the Security Experts > Security Management Questions & Answers > What is the best way to administer exams to students via computer?
Ask The Security Expert: Questions & Answers
EMAIL THIS

What is the best way to administer exams to students via computer?

Mike Rothman EXPERT RESPONSE FROM: Mike Rothman

Pose a Question
Other Security Categories
Meet all Security Experts
Become an Expert for this site


Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us   


>
QUESTION POSED ON: 09 January 2008
I work for a university that is considering having students take examinations on computers. One option is to have lecturers create exams as Microsoft Word files that are uploaded to an HTTPS server and then downloaded in public computer labs, where the students take the exams. Completed exams are uploaded to the HTTPS server. The other option is to have lecturers convert exams to PDF files and upload them to the HTTPS site; the PDFs are downloaded and printed out and students do their exams by hand. Completed exams are scanned and uploaded back to the HTTPS site. It seems obvious to me that excluding the labs from the process would reduce risk considerably. What's your view?

>
EXPERT RESPONSE
The first issue that jumps out at me is authentication. It's not clear from your brief description how you plan to make sure that the right student is actually the one submitting the document. In the case of the Word file, there is really no way to enforce that, unless some kind of digital signature system is enforced to "sign" the paper as it's submitted.

The case of the uploaded PDFs provides a bit more integrity in the system because handwriting can be verified. I would suggest taking a step back and finding out what the business need is for the students to submit the tests online. Is this a distance learning environment? Is there an issue with using paper? I guess I'm dating myself, but the processes as described seems to be a solution looking for a problem, which isn't clear from your question.

There are many educational learning systems available today that would allow students to take tests online. Filling out questions, either multiple choice or essay and having the data deposited into a database for grading, etc., would be a better option than the kluge that you described.

In terms of the public computer labs, I'm not sure how you would restrict access. In a university setting, students need to be able to access the systems from anywhere on campus. Are you suggesting that they can only take the tests, or upload the files from a central place? Again, that would seem to defeat the purpose of the automation in the first place.

That's why I'll go back to the first statement I made about authentication. If you have the proper way to verify identity, then where the students access the system or upload files doesn't really matter.

For more information:

  • In this tip, Noah Schiffman discusses the positive and negative aspects of both IP-based and signature-based email authentication.
  • Joel Dubin explains why identity-enabled network devices offer an extra layer of authentication.


  • Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us   


    RELATED CONTENT
    Security Management
    What's your advice for getting other business units to contribute to crafting an effective information security policy?
    How can organizations secure implanted microchips and RFID tags?
    Any recommendations for recruiting information security pros?
    I am concerned that a former employee will utilize corporate information in a malicious way.
    Is it necessary to grant a full administrative privileges to a security administrator?
    Recently I found my computer's serial number had been reported stolen. Will I face legal repercussions?
    What are the possible benefits of microchip implants and RFID tags for employees?
    Is it against HIPAA regulations to permanently store sensitive information?
    Two-tier distributed systems vs. three-tier distributed systems
    How to prevent software piracy

    Two-Factor and Multifactor Authentication Strategy
    What should an enterprise look for in a password token, and in a vendor?
    If the encryption on the Mifare Classic RFID has been cracked, are smart cards insecure?
    How do RFID-blocking passport wallets work?
    What are good features to look for when searching for new access control software?
    Quiz: The new school of enterprise authentication
    The steps of privileged account management implementation
    The New School of Enterprise Authentication
    Trends in enterprise identity and access management
    Address Authentication and Transaction Validation Protocols to Stem Identity Theft
    Understanding multifactor authentication features in IAM suites

    PKI and Digital Certificates
    Should computer exams be transmitted as PDF files or Word files?
    Should PKI systems be used for laptop encryption?
    Email authentication showdown: IP-based vs. signature-based
    VeriSign to shed businesses, return to security roots
    How do anonymous credentials and selective disclosure certificates affect enterprise IAM?
    Choosing from the top PKI products and vendors
    Can the symmetric encryption algorithm for S/MIME messages be changed?
    Securing VoIP Networks: Threats, Vulnerabilities and Countermeasures
    Creating a personal digital certificate
    What are the alternatives to RC4 and symmetric cryptography systems?
    PKI and Digital Certificates Research

    RELATED GLOSSARY TERMS
    Terms from Whatis.com − the technology online dictionary
    AAA server  (SearchSecurity.com)
    authentication  (SearchSecurity.com)
    authentication, authorization, and accounting  (SearchSecurity.com)
    federated identity management  (SearchSecurity.com)
    Kerberos  (SearchSecurity.com)
    password hardening  (SearchSecurity.com)
    typeprint analysis  (SearchSecurity.com)

    RELATED RESOURCES
    2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems
    Search Bitpipe.com for the latest white papers and business webcasts
    Whatis.com, the online computer dictionary



    Search and Browse the Expert Answer Center
    Search and browse more than 25,000 question and answer pairs from more than 250 TechTarget industry experts.
    Browse our Expert Advice



    Find Security Solutions for Your Business
    Targeted Security Channel Tips for Resellers, Integrators and Consultants
    TechTarget Security Media
    Information Security View this month\\'s issue and subscribe today.
    Information Security Decisions Apply online for free conference admission.
    SearchSecurity.com
    HomeNewsMagazineMultimediaWhite PapersLearningAdviceTopicsEventsAbout Us

    About Us  |  Contact Us  |  For Advertisers  |  For Business Partners  |  Site Index  |  RSS
    TechTarget provides enterprise IT professionals with the information they need to perform their jobs - from developing strategy, to making cost-effective IT purchase decisions and managing their organizations' IT projects - with its network of technology-specific Web sites, events and magazines.

    TechTarget Corporate Web Site  |  Media Kits  |  Reprints  |  Site Map




    All Rights Reserved, Copyright 2003 - 2008, TechTarget | Read our Privacy Policy
      TechTarget - The IT Media ROI Experts