Personally, I am an advocate of Open Source and I am very keen on Moodle
for which I have set up 400 courses in the School of Lifesciences. However, I have
been questioned about the security of Moodle of systems such as WebCT
and Blackboard for summative testing. Does anyone have any knowledge on the security aspects of moodle? Is it as reliable as other systems?
Thanks in advance,
What do you mean by secure?
Does not crash?
The extent to which Moodle might crash are largely governed by the server you are using and the limits of the database, of which moodle can use a variety (MYSQL, POSTGRES etc). We hear that moodle is faster than its commercial competitors so perhaps it is less likely to crash the database. In any even, Moodle it self is very robust and scalable.
Crashes do not matter?
Moodle has a good automated backup system (and one can easily add external secondary backup systems) so that even in the event of a system malfunction (I have not experienced one) the automatically generated backups are available.
The vast majority of the problems that I have seen reported on these forums were caused by user error. Either way the support is 24 hour and fast so problems do not usually remain problems for long.
Prevents Cheating (and there are many different ways)?
There are no known ways of hacking moodule into the results of moodle (other than by cracking a password username combination which is doubly difficult since neither usernames nor passwords are displayed).
There are ways make it difficult to copy moodle pages.
Quizes are randomised (both answers and questions) and may be drawn from a pool of questions at random.
I have noticed a couple of upgrades that are aimed at preventing Moodle from being hacked. There was an upgrade of this type recently. In both cases the upgrade came before any hackers noticed the weakness. I have yet to year of a definate case of hacking.
You may need to be more specific about what questions you are being asked with regard to security of summative assesment. Salespeople often create impressions of software's capabilities that are somewhat out of touch with reality, particularly when the salesperson and/or the customer is non-technical. And Moodle cannot hope to compete against vague or fictional capabilities of other systems.
In general, I believe the security of summative assesments have very little to do with the VLE system itself, and more to do with processes and preparations that surround the test e.g. note items 8 through 13 of this checklist for summative testing in WebCT:
I think that as an off-the-shelf package Moodle competes well but the support is different.
In most ways the free support here at Moodle.org is far better (I bet my bottom dollar, twice over). But there are times when a commercial system may win because you are paying for support. If you were to employ Martin or a Moodle Partner then you would get the same sort of gaurantees that a commercial vendor supplies, because that is Moodle commerce -- support.
As an example... Recently a version of moodle was found to be hackable by the developers. They released an free upgrade and there has yet to be any instance of hacking in the wild. I can upgrade for free. I pay nothing for using Moodle.
But, if I were paying the $50,000 a year that the commercial systems charge then it is possible, or even likely, that the vendors would provide a patch for my system. But since I pay nothing, it is up to me to patch, or upgrade, the system myself. If I paid someone maybe $2000 (i.e. 1/25 of the yearly charge of a commercial system) then I am pretty sure that I could purchase that patch. But while paying zilch, I can not expect to get the peace of mind that I might get from commercial support.
So if you want very high levels of peace of mind, then expect to pay a Moodle partner to support your system, or use a portion (10%?) of the $50,000 that you have saved to employ someone to support Moodle.
I have been using Moodle for 18 months, with about 30 courses and up to about 1000 active students, and I have experienced no security problems.
I thought I had a problem once but it was my imagination. At the same time, I wish I had the money to employ a Martin to support my systems for the peace of mind.
There are two ways to solve the secure question:
- Use Moodle during your course - it is secure enough: even teachers cannot change the results of the built in tests - and organise a complete set of tests and assignments and groupactivities so you get a complete impression of a student, not only that final test suite. (So, do formativ evaluation / testing..)
- OR ..go real secure:
- disconnect your final test from the moodle system (no technical cheat)
- let other teachers create and maintain these final tests, not the course teachers.
(so, no teacher cheat to help his students. Belief it or not, it is one of the arguments in the portfolio discussion..)
- let at least two teachers do the grading of open questions and create Rubrics for them to reduce the personal bias
- build a room with a Faraday cage around it (No wifi or bluetooth or other wireless cheat)
- Put no windows in that room (No American Sign Language cheat)
- Do a personality check and allow only a secure ID-card like the US-password. (No ID-card cheat)
- Put every student in a separate box (No peer cheat /ASL cheat)
- Do a body check (No cheat paper cheat)
- Take away small devices like calculators and GSMs (no electronic cheat paper cheat) offer them clean calculators of the same brand instead.
- Make sure that every test is unique (random from a very big pool of questions.)
- and last but not least: do not drop the the paperdrafts of the tests in the basket in your office.. but burn it, before you leave the office and the cleaning team enters your room. (Welcome in the real world)
love the list
have you been listening in at our coffee machine
what about them using e-mail ????
i have found that the effort some students put into 'cheating' actually helps them to concentrate on what is being tested so...
the other problem is the time it would take to ensure
your unique (random from a very big pool of questions."
Without mentioning names I have software that I find rather scary that actually contains long lists of "exploits" which if pointed at machines will automatically check for "vulnerabilities". So far I have not even hit the go button to test it and if I did I think I would turn off my broadband router just to be absolutly certain that I was addressing machines I owned rather than ones belonging to anyon else.
So the world and his aunty are working on getting access to your OS and database. How many people are trying to break into Moodle directly. I suggest the answer is "not a lot".
I am not making any comment on the actual security in Moodle, just that if you really want to break into software you go for the weakest link and use tools that are easily available.
But in my experience when people ask about security they often overlook the weakest link. The people who run the system
Note that this isn't strictly relevant to Moodle as the system that was the centre of that discussion was a 'campus credit card' style system that had been bought and re-branded to complement their learning system (though the approach to security in general might be inferred).
Short version: The two students settled with Blackboard as their investigations into what they claim were security flaws of the system breached some kind of corporate espionage law. Blackboard maintain there was no problem with the system.
An informative FAQ has links to related settlements, press releases etc.
There are tons of reported bugs in our commercial LMS that hade gone through several versions and a number of patches without being fixed, so the above is only true if the company's marketing dept. decides they will lose more sales by admitting the bug exists and fixing it than by hiding it, generally this means bugs need to be publically reported, and demonstrated, before a patch is released, and it may take a good deal of time while the process winds through various commitees and departments at the company in question. Finally, since you can't inspect the patch yourself, you have no way of knowing whether new bugs are introduced by the fix until a new bug is publically reported and the process starts anew.
Adding to the issue is when the commerical LMS relies on a commercial OS and database software. In such cases, patchs --even critical patchs (for instance) to Windows Sever or MS SQl must wait until the LMS has tested them and (in some cases) released patches of their own to provide compatibility.
Thus IMO, OSS products may be default be more secure than CSS products, though of course for an educational institution with a limited IT budget, hiring a Moodle consultent to set-up and maintain the system is a good idea and probably much more cost effective than paying a commercial license, just that I think that following the install instructions, registering for secutiry updates, and using a well supported (security-wise) server OS (like RHE or MacOSX), Moodle out of the box is as (or more) secure than Blackboard/WebCT, and dusers don't need to pay extra consultant fees to ensure that.
A reasonable person would certainly expect that.
I don't want to name specific incidents or specific products, but I can assure you that that's not always the case.
The Moodle team (including Martin, all the other developers, and all the people who post on this forum) is much more responsive and helpful than any commercial CMS vendor with which I am familiar.
The main issues are with students helping each other, which is pretty much a given with any online testing platform. Students work together on tests in labs, have test taking parties with their laptops, send eachother pictures of the questions on their cell phones, etc.
WebCT, BB, and Moodle tests are all about equivalently vulnerable in this area. Solutions include question randomizing, one at time questions, and time limits. Time limits are probably most helpful, and Moodle is much better at this than Blackboard (where in our experience, time limits are very buggy, esp. on non IE browsers). With a good set of random questions and a reasonable time limit, cheating is more likely to hurt student's grades than help them. One at a time question presentation further increases the difficulty in cheating, though for this in Moodle you'll have to use lesson rather than quiz (see our lessson_cdc in contrib for time limits, passwords, and question clustering in lesson).
If you are using summative online tests as a major part of the assessment, then spending time making lots of equivalent questions for randomization is essential to getting authentic assessments. Other strategies include having the summative tests be held in proctored computer labs, and of course basing a larger part of assessment on constructive activities such as forum participation, projects and papers than on tests.
Generally, I recommend that our fully online faculty base a larger part of the student's grades on forums and summative projects/papers and a lesser part on online tests if possible, and if not, generate lots of sets questions (or import question pools) and use randomization and time limits to reduce the payoff of cheating.
As with cheating in face to face classes, one can never stop it 100%(picture cell phones for instance are becoming so commonly used for cheating in traditional testing that many colleges are investing in cell phone jamming equipment!--resulting in students investing in cell phones that can evade the jammers, ad infinitum...), generally you can make it more difficult for most students than learning the material.