I have my own moodle site that I administer myself at Cloudways. I use it with my high school classes.
Can anyone tell me about potential problems I could run into with FERPA? The site is incredibly useful to me, but I also want to be respectful of both student privacy and the law.
Please see:
https://docs.moodle.org/24/en/FERPA
As far as 'potential problems' ... does your ISD have an administrator who wears some sort of hat where FERPA questions/issues/concerns of students and parents would be handle through that person?
Probably best to talk to local persons responsible ... not every community is the same. ;)
'spirit of sharing', Ken
Ken,
Thank you so much for your response. You likely do not remember me, but I want you to know that you have been so incredibly helpful to me in the past.
The concern voiced by the tech department was that my moodle installation at Cloudways could be hacked, and then people would have access to student quiz scores.
Can you tell me if having a moodle installation at a managed cloud hosting platform like cloudways constitutes a security risk? I have been running under the assumption that by hosting my site a Cloudways that they have the security covered at least as well as a typical school district might.
So you have two pieces - Cloudways and Moodle. Server security questions need to be addressed to Cloudways. Moodle is pretty concerned with both security and privacy and constantly updating to address any found issues. You will need to also update as needed.
But, as we all know, hackers are pretty good regardless of level of security. How badly are they going to want to hack your Moodle server though? - probably not on the same scale as somewhere they can make money!
First ... a comment ... so your IT department is claiming that if your Moodle was hosted internally and not in the cloud that it would **never** be hacked? Uhhh ... me thinks that claim has only some merit in that attack vectors might be reduced in number, but never 100% ... that would be dependent upon just how good your IT department really was ... remember, port 80 ... and the site is accessed not only internally but externally - and by multiple devices. Kinda amazing what kids can do with their smartphone if allowed to connect to the private LAN/WAN and the internal WiFi isn't segmented/controlled.
Well known that in a private network, the greatest threat is internal users.
Do know that internal IT folks have their plates full ... so let's say your Moodle was hosted internally. Would they maintain not only the OS updates but updates/upgrades to your Moodle?
Believe it or not, I supplement my retirement by providing remote support for Moodles on Linux boxen because internal IT doesn't want/can't/don't have time, etc.. And I'm contacted by jr colleges/K12 entities that have sort of ignored the Linux 'black boxen' that no one has maintained/managed ... philosophy of 'if it's working, don't fix it' ... for a few years and now they want to blah/blah or 'fix' something 'broken' ... well, DUH! :\
Anyhoo ... let's talk about the services that CloudWays provides you as 'managed' ... first of all that means they manage everything but your Moodle. They keep the OS and services up-to-date with the most recent/secure versions. Am I right so far? IF that's true, then what is the version of PHP on your server (that's just an example)? Now CloudWays would never confess their servers/network are vulnerable, would they?
Even if Cloudways does their job, the bad guys are really always one step ahead of the bad guys ... uhhhh, that sounds sexist ... should include bad girls as well.
Now remotely hosted in the cloud ... yes, there are backdoors on such networks ... Google Compute Engine and Amazon and Rackspace as examples ... probably true of CloudWays also ... there is an internal private network ... a 10. Really meant for internal/customer support but customers who are network aware and have VPS's aren't necessarily prevented from using that 10. network. Network infrastructure is moving to the cloud as well these days.
So when one really looks at things overall ... security is really a 'best effort' sorta thing. As long as one keeps the OS up to date *and* the apps (like Moodle) on supported/secure versions ... and one doesn't do something crazy ... then those involved have done all that is humanly possible .. right?
Guess what ... right now, there are many many many workstations/servers/virtualized servers/containers whatever vulnerable to a hardware thing(s) called Meltdown and Spectre - Intel chips as well as AMD now also. Conditions to exploit remotely difficult, but can be done ... so I read. Makes no diff where one host ... cept Google (so they claim).
'spirit of sharing', Ken
Hmmm. They said that if my site were compromised by hackers, then the state could revoke my teaching license. I must admit that my moodle installation, hosting only my two classes, does not get updated as often as it should.
That being said, when my district did host moodle internally, years ago, we were still running version 1.9 in 2013, which seems to be after it stopped being supported. This seems to be a rather low bar to clear as far as comparative due diligence.
The district is now on Schoology, which is hosted by Schoology. I am still using moodle because back of the envelope calculations tell me a LOT of time will need to be invested in porting to Schoology, fixing the issues, and coming up with new solutions for quizzing students (many great moodle quiz functions are not supported by schoology).
I would still do it if I felt that this investment of time would result in more benefit for the students than if that time were invested elsewhere.
The students, by the way, love my website. Not so much because of any awesome functionality, but because it is clean, simple to navigate, and has great resources.
I am quite hesitant to convert my site to Schoology, as the district is already talking about switching to yet another learning management system. Canvas seems to be one option, with Google classrooms as another.
I really like being on moodle, as it allows me to focus my time on teaching and creating supporting materials rather than spending my time dealing with what looks to be a periodic churn from one LMS to another.
"They said that if my site were compromised by hackers, then the state could revoke my teaching license."
That might/might not be true. Not that I'm encouraging you to take on your what sounds to be your entire ISD ... admin/campus admin/and IT ... maybe even State ... but ...
and if that same thing happens to anything managed by internal IT or for which IT is the first point of contact on something remotely hosted like Schoology, do they loose their employment with the ISD?
Uhhh ... haven't there been large corps (EquiFax being just one) that have been hacked and didn't inform customers until exposed? Think Schoology would do something like that?
Afraid, my friend, you are involved in 'Who Moved the Cheese?" (as we *all* are!)
'spirit of sharing', Ken
Follow up ... just for grins think I'd ask whomever told you a hacked site could result in revocation of your credentials to teach.
Please see:
The only thing I see on there ... 'conduct un-becoming' ... there is mention of this:
"Using technology to intentionally host or post improper or inappropriate material that could reasonably be accessed by the school community."
That's NOT you!!!
That sort of FUD has no place in a school ... any school!
How many teachers on your campus/ISD use Moodle? Any ISD 'power players' among those?
In a comparison of how your students perform (using Moodle) vs other students performance (using whatever) is there a difference? Can one attribute the use of Moodle as a major factor?
I'd say your school is doing something right ...
Here again ... not trying to preach revolution here ... the important thing is for you to remain a teacher and teach, right?
'spirit of sharing', Ken
Ken, prior to reading your posts, I was thinking the same way about Curt's situation.
As you probably know, I host my own Moodle. At the last school where I worked, they were always trying to find ways to tell me that I couldn't run Moodle. "Your Moodle is not secure." You can't put grades in an external system." and even the FERPA scare tactics. The interesting thing is that the school's servers were regularly "down," and IT had some people with no IT background administering their servers. Also, without any of my encouragement at all, students would visit IT and complain about the school's LMS saying "Why don't you use Moodle like Dr. Jerz does. It's a lot better than..."
Whenever I am faced with these bold claims, I always ask for documentation. I want the real scoop on what they are claiming (like some of the information that you found.)
Well, what can I say? Some people like to think that the IT staff should control education and that they are the "teachers."
(In my current school (big 10), IT doesn't seem to mess around with "academic freedom." Many different products are used to teach.)
<begin rant>
IMHO ... posters in Moodle should fill out their profile with info about their situation. Don't have to provide links to sites nor 'name names', but knowing a 'situation'/climate/environment, makes a diff!
A K12 situation is a lot different than a JC or College or Uni. Higher Ed does have 'academic freedom' ... that is not the case with K12 public schools ... even if the teacher involved might be a 'master teacher' with Dr. or higher than Bach. degree. Granted even a 'shingle' like that doesn't mean they are a great teacher, also!
K12, to me, is 'fickle' ... all it takes sometimes is a good sales pitch to an influencer and/or the decision makers who don't consult with anyone (0 consensus nor survey of parties involved - *all* (which includes parents and students) and off they go - could be a short jaunt (1-2 years) ... and an expensive one at that ... in the end ... decision maker leaves ... new decision maker ... new LMS decision. And there really hasn't been any improvement to instruction, etc..
Some schools just don't learn from their own mistakes and histories. :\
To some Board members, 'moving the cheese' is good ... just for the sake of moving!
</end rant>
'spirit of sharing', Ken
I am really the only person in my entire district that is using moodle, as far as I know. I decided to host my own moodle installation after the last tech department completely lost one of my courses and could not recover it. This is after I had advised them several times that the backup system was not working. (I was unable to make my own personal backup and keep it on my own computer.) The change in file system structure from 1.9 to 2.0 caught them by surprise, and they could not recover just my files without affecting the rest of the district.
After about 150 hours of recreating my course, I decided to host my own site and have not looked back. It has run flawlessly for many years. I see no benefit for the students in changing. Certainly no benefit that would pay off nearly as much as spending that time doing other things to make my class better.
That is the bane of a k-12 educator. If I were in a line of work where the organization would have to compensate me for the work necessary to change platforms, I think they would give a lot more thought to the costs vs benefits of making a change.
I don't really want to take on the IT department, or anyone for that matter, as I have other things that I would like to do, and certainly would find more enjoyable.
I wonder what I would have to do with my installation in order to be able to successfully argue that I am doing due diligence as far as protecting student records. Certainly updating my installation periodically would be a good step. I imagine that I could have the students names changed to just the first name and last initial. Ceasing the use of quizzes would help, but that function is too beneficial to my students to give up.
As far as the benefits to my students, I think their scores on the AP test speak for themselves. Without the benefit of a double block or a prior year of physics required, they do quite well.
Well, from what you've shared ... sounds like you are doing what you should be doing in teaching .... so ... even though you don't want to take on IT kinda sounds like you would have to prove to IT (or powers that be) whatever 'whoopied' with IT to suggest your site was not secure. Many times those sorts of web checkers etc. get 'false positives' ... so knowing what it is/was IT department used and sharing that info here might give info enough to suggest IT department check that out via other means.
So let's address this:
"I wonder what I would have to do with my installation in order to be able to successfully argue that I am doing due diligence as far as protecting student records. Certainly updating my installation periodically would be a good step. I imagine that I could have the students names changed to just the first name and last initial. Ceasing the use of quizzes would help, but that function is too beneficial to my students to give up."
Definetly invite other Moodlers with experience in securing moodle to jump in here and share their knowledge/experience ...
I'll begin by saying ... yes, you should be running a supported for fixes/security fixes especially version of Moodle. Supported versions are 3.4,3.3 and 3.1 (the latter is long term support now for security only - not much longer now that 3.5 is just around the corner).
So please share what version of Moodle you are currently running so we can discuss/cuss what the plan for upgrading would be.
2nd ... is your site running https with a valid certificate. IF not, set your server up with a valid cert and run your moodle under https all the time.
3rd ... this relates to the suggestions above ... more a resource/reason for you to upgrade:
https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=Moodle
Now remember, when one reads those security issues, that some have conditions to them .... many issues with a Linux box, for example, require the user have shell access to be able to do xyz. The ones to be really concerned about are cross site scripted and that don't require a login at all (all port 80).
4th ... run your site such that one has to login first to see anything at all.
5th ... remove calendar, participants/logged on user blocks from Front Page ... even if forcing all to login to view anything.
Is your site setup to use devices ... like the mobile app? That uses web services ... which have to be turned on in Moodle to work. IMHO, web services are kinda 'stealthy' and one should pay more attention to those now-a-days.
That's enough to start, me thinks!
'spirit of sharing', Ken
One more important resource in your efforts:
You might see the same CVE identifiers.
Been looking but haven't found a security scanner that is specific to and for Moodles.
'spirit of sharing', Ken
Curt, you might consider having your IT department articulate exactly what they see as the vulnerability. Tell them that you have excellent worldwide support for your moodle, and if there is a problem, someone on your "Moodle support team" will help you address it.
You might also ask them to demonstrate that they can easily break into your Moodle. (They are the experts, right? So they should be able to break in.)
Last, if they simply say "Moodle is not secure" you might point out that Moodle is used by many schools and organizations throughout the world. (I was fortunate to point out that my old school's major competitor in town was successfully using Moodle. Of course, this was a little embarrassing to the IT staff.)
One more "proactive" suggestion. You might want to get the book "Moodle Security" by Darko Miletic. It might have some pointers for you.
Ok .... Bad news and Good news ... depending ...
found your site on CloudWays. It is a version 2.9.x and probably is vulnerable to the issue reported to you by your IT department. So if you to continue to host there (see the good news below), then upgrade the Moodle.
The Good news ... back in 2014 your school district began to use Schoology but they also embarked on Google for Education ... Google Drive etc. for all campuses/all students ... assuming that has continued, you and your students already have google accounts.
For you that really is good news ... but there are *IF's* ...
First, your IT department would have to install either a Ubuntu 16.04 or a CentOS 7 image on Google's Compute Engine giving that instance more memory and cores etc. than you probably have now where you are hosted. Just a minimal install of the OS's. Next they could install an open sourced cPanel called Webmin on that instance to help admin the instance.
It would have a public IP address and IT department could give your server a FQDN ... needed for Moodle or any hosting ... something like mrbixel.yourISDtopLevelGoogleDomain.org. Server will have ssh access via a Google authenticated control panel and it's through that moodle could be installed via git ... which means it's easily updateable and upgradeable.
The IT department is in control of that instance ... should you retire or take employment else where (don't see that happening anytime soon), the IT department simply deletes the CGE instance and removes DNS that pointed to it. Each GCE has it's own firewall ... here again, IT department would be involved.
Now the *really good news* ... versions 3.3+> of Moodle have Google Oauth2 as part of core for Authentications. If you set that up and restrict the domain in Moodle to just the EMail domains used by your school ... how much more secure can you get?
Install a fresh 3.3 or 3.4 and simply restore backups of your 3 courses onto the new host.
You get to keep your quizzes ... and gain ... unlimited Google Drive space ... for you and your students. The use of Google docs and any Google extensions.
It would take some time to set all that up and get your course backups installed on the new digs.
The beauty (depending) of such a thing ... IT is being pushed to use their Google Cloud ... in a way they may not have thought about before. And they can turn admin of that server over to you ... without any worry! (if you are willing to learn a little more about things like Webmin.
Now I wouldn't suggest such a thing without having some experience at it ... I do have a Google Compute Engine instance running CentOS 7 with version 3.3 of Moodle that is using Google Oauth2 (my personal, not a Google Domain for Education). All that does work. Even setup a demo of exactly the same same thing for a small district in South Texas that had 'gone google' some time ago. But, teachers opted to use Google Classroom exclusively.
You have my addie via PM on this system if you'd care to discuss/cuss this some more.
'spirit of sharing', Ken
I am pretty good at figuring out things having to do with IT. I did learn quite a bit with my moodle installation including CPanel, php and config files, etc. At one point, I even got my site to automatically update with Github.
At the same time, I have a lot of other irons in the fire. Any idea how much it would cost to have someone else host moodle for me in a secure manner that would not cost too much. I have about 150 students and 3 classes.
Have you explored MoodleCloud?
Understand about 'irons in the fire' ... such is the life of a teacher ... also 'shadow IT'!
The question about hosting ... top of my head ... don't have/nor maintain a list of hosting providers that fit the criteria. Major factor for you, of course, is cost .... how much is too much?
Someone might jump in here and suggest MoodleCloud, but the question for you would be if you have any addon for Quizzes ... or any addon ... that doesn't come 'standard' with MoodleCloud. But by all means, check them out:
And hope anyone with knowledge about MC would jump in here to help this teacher out! ;)
Gonna stick my neck out and say that just about any hosting provider (for you, with data centers in the USA) that offers a VPS - CentOS 7 or Ubuntu 16.04 with at least 8 Gig memory and diskspace enough to house your moodledata directory would do.
So how much space is your moodledata directory taking up?
'spirit of sharing', Ken
Ken (and others), you might have some thoughts about the solution that I have right now.
Well, many folks do not like GoDaddy. However, GoDaddy is the largest hosting company, and they probably know more about security than any school's IT staff. So from the server side, I would find it hard for someone to argue that Godaddy's servers are "not secure." There are probably many other good hosting providers with equal security.
Then, it's just on the Moodle side where you need to take care of things, following some of the suggestions already made.
Cost: Depends... but figure $20US - $30US/month for a VPS. I pay this myself, not my school, and I find it within my budget for what I seek to do in my courses.
This VPS is one that you manage, and you have a lot of control over the components. For example, mind is running php 7, MariaDB, Opcache, and I have optimized my database and php settings (php.ini and my.cnf).
Well, takes a bit more education. Nothing too major.
Yes, you can move your current moodle to a VPS (if you know what you are doing.)
I do not own stock in GoDaddy nor do I have any affiliation with them. I have used GoDaddy for about a dozen years. My experience is that their servers do not go down. Oh, one more thing... GoDaddy does not provide Moodle support (nor MS Office, nor PC, etc.) Their business is servers.
By the way, would upgrading be as simple as making a backup copy of my two courses, installing a fresh version of moodle 3.4, and then restoring my two courses?
And, by the way, is my profile missing any important/useful information?
New instance for a 3.4 then restoring course full backups (with student info/data) should work ... as long as in the new 3.4 instance any addon you have been using in courses is installed in the 3.4 prior to attempts to restore the courses.
As far as what's in profile ... that's up to you ... please see mine as an example of what you might consider including. Not that my profile is the 'best' example.
'spirit of sharing', Ken
