Privacy and Security in E-Learning

Abstract

/npsi/ctrl?action=rtdoc&an=5763176&lang=en http://nparc.cisti-icist.nrc-cnrc.gc.ca/npsi/ctrl?action=rtdoc&an=5763176&lang=frAccess and use of this website and the material on it are subject to the Terms and Conditions set forth at http://nparc.cisti-icist.nrc-cnrc.gc.ca/npsi/jsp/nparc_cp.jsp?lang=en NRC Publications Archive Archives des publications du CNRC Privacy and Security in E-LearningYee, George; Xu, Y.; Korba, Larry; El-Khatib, K. ABSTRACTFor a variety of advantages, universities and other organizations are resorting to e-learning to provide instruction on-line. While many advances have been made in the mechanics of providing online instruction, the needs for privacy and security have to-date been largely ignored. This paper examines privacy and security issues associated with e-learning. It presents the basic principles behind privacy practices and legislation. It investigates the more popular e-learning standards to determine their provisions and limitations for privacy and security. Privacy requirements for e-learning systems are explored with respect to the "Privacy Principles". The capabilities of a number of existing privacy enhancing technologies, including methods for network privacy, policy-based privacy/security management, and trust systems, are reviewed and assessed.Keywords: e-learning; distance education; information security; on-line privacy; privacy principles; network privacy; policy-based management; trust mechanisms INTRODUCTIONOne of the key characteristics of our information economy is the requirement for lifelong learning. Industrial and occupational changes, global competition, and the explosion of information technologies have all highlighted the need for skills, knowledge, and training. Focused on attracting and retaining staff, companies have placed an emphasis on training to bolster soft and hard skills to meet new corporate challenges. In many cases, career training has been placed in the hands of employees, with the understanding that employees must be able to keep ahead of technological change and perform innovative problem solving. One way of meeting the demand for these new skills (especially in information technology) is through online e-learning, which also offers the potential for continuous learning. Moreover, e-learning provides answers for the rising costs of tuition, the shortage of qualified training staff, the high cost of campus maintenance, and the need to reach larger learner populations.From the corporate perspective, employee training is an approach to increase the level and variety of competencies in employees, for both hard and soft skills. On-line learning has become an important tool to implement corporate learning objectives. Indeed, specific e-learning courseware may be used to target specific corporate needs pertaining to strategic directions. Key trends for corporate e-learning, germane to privacy and e-learning include Hodgins, H.W. (2000):• Learners may access courseware using many different computing devices and from different locations, via diffe...

E-Learning Software Security: Tested for Security Vulnerabilities & Issues

“…In [1] the authors examined the privacy principles that have to be applied during the implementation of e-learning software, along with the identification of components that require privacy and security safeguards. All this is described in a pure theoretical level of prevention.…”

“…For various reasons, not all of them apply to web based e-learning software 1 . The most serious of those mentioned that can be applied here, are: (1) SQL Injection (2) Cross Site Scripting (3) Buffer Overflow or similar weaknesses (4) Sensitive Information transmitted over http (Not over https).…”

Exploiting Policies in an Open Infrastructure for Lifelong Learning

“…Furthermore, using Shibboleth implies the existence of institutions users belong to -which is an assumption that does not apply in an open scenario for lifelong learning. [6] provides an abstract overview on privacy and security issues in advanced learning technologies, suggesting that policies may be used in an educational context. But neither scenarios nor specific details are provided.…”

Effective Collaboration with Information Sharing in Virtual Universities

“…The well-known least privilege security principle can be implemented through partial delegation. Although the concept of delegation is not new in authorizations [6], [11], [36], [38], role-based delegation has received attention only recently [40], [41]. Aura [6] introduced keyoriented discretionary access control systems that are based on delegation of access rights with public-key certificates.…”