See discussions, stats, and author profiles for this publication at: https://www.researchgate.

net/publication/224573972

Managing Security in a New Learning Management System (LMS)

Conference Paper · July 2009

DOI: 10.1109/ITI.2009.5196105 · Source: IEEE Xplore

CITATIONS READS

2 2,171

4 authors:

Adrian Besimi Visar Shehu

South East European University South East European University
23 PUBLICATIONS   53 CITATIONS    17 PUBLICATIONS   77 CITATIONS   

SEE PROFILE SEE PROFILE

Lejla Abazi Bexheti Zamir Dika

South East European University South East European University
44 PUBLICATIONS   235 CITATIONS    46 PUBLICATIONS   172 CITATIONS   

SEE PROFILE SEE PROFILE

Some of the authors of this publication are also working on these related projects:

Wireless Health Care and Security View project

SCOPUS Project View project

All content following this page was uploaded by Visar Shehu on 16 May 2014.

The user has requested enhancement of the downloaded file.

 Managing Security in a New Learning Management System (LMS)
Adrian Besimi1, Visar Shehu2, Lejla Abazi-Bexheti3, Zamir Dika4
Contemporary Sciences and Technologies - South East European University, Macedonia1234
a.besimi@seeu.edu.mk 1 v.shehu@seeu.edu.mk 2 l.abazi@seeu.edu.mk 3 z.dika@seeu.edu.mk 4
Abstract. Common security problems when
creating a new system range from basic browser
authentication to physical access to servers. The
security perspective in e-learning systems is
often ignored, and this why this paper tends to
emphasize common security issues when
developing new Information Systems.
We introduce a three layered security
measure, such as: the physical control layer, the
software control layer and the social engineering
training. These three layers tend in various
methods to secure users credentials and other
data in the newly created Learning Content
Management System (LMS).
Keywords. Information systems security,
Learning Management Systems security, LMS,
physical security, software security, social
engineering, phishing, Access Control List,
ACL.
1. Introduction
The success of e-systems on one hand
depends on the customer satisfaction after the
solution is created, and on the other hand this
success depends on the usability, integration and
security.
Security is crucial when dealing with
information systems at universities or large
organizations, since many users can cause many
worries.
E-learning system developed at South East
European University (SEE University) in
Macedonia is a complex system [1]. Except for
its primary function, which is data or learning
content delivery, there is a need for security
functions, whose main duties will include access
to data and files, control of these data and files
and managing the same data and files, without
interfering with each-others content.
Common security problems when creating a
new system range from basic browser
authentication to physical access to servers. The
security perspective in e-learning systems is
337
st
Proceedings of the ITI 2009 31 Int. Conf. on Information Technology Interfaces, June 22-25, 2009, Cavtat, Croatia
often ignored, and this why this paper tends to
emphasize common security issues when
developing new Information Systems.
In order to manage the potential security
flaws, three layers of security are presented in
this paper:
• Physical Control Layer – manages the
physical access to the University network.
• Software Control Layer – manages the user
credentials by a domain controller and the
custom Access Control List (ACL) delivering the
Roles inside the application.
• Social Engineering Training – manages the
human nature regarding the security.
2. Physical Control Layer
Physical security describes measures that
prevent attackers from accessing a resource, a
facility or similar. In large organizations this is
carefully handled by IT network administrators,
which is the same case as in our University.
Basically, any access to the University
network is prohibited to users that already have
physical access [5] to the University campus.
Even the wireless access is limited to an area
which falls under the University property.
South East European University (SEEU)
network access is managed by a CISCO router,
which requires domain credentials in order to
obtain access. This router has a built-in function
for intrusion detection which eliminates the
possibility from outsiders (non-University staff
or students).

Figure 1. Simplified University network
schema and infrastructure architecture for a
LMS solution
Furthermore, the network is virtually
separated on multiple VLANs[4]. Users upon
authentication are connected to their appropriate
VLAN depending on their access permissions or
status on the university. Guest users for example
are limited on using only basic networking such
as internet access for sites outside campus.
As seen on Figure 1, the physical network is
divided into several VLANs (Virtual LANs)
which separate networks from accessing the
main database and domain servers. This schema
prohibits any user, including the ones from the
Intranet (VLAN 3) or Internet to access servers
that contain sensitive data, like the University
Central Database on VLAN 1.
In order to increase the security to a upper
level, we introduced a Proxy Server on VLAN 2,
which has direct access, restricted by IP, to the
University Central Database and Active
Directory on VLAN 1. This way, the LMS Web
Server will have read-only access to sensitive
data and user accounts from VLAN 1 servers. On
a possible attempt of attack to the LMS Web
Server, the sensitive data remains secure on the
VLAN 1.
3. Software Control Layer
This type of security control is carried on the
application level. During the system
development, there was a need for several types
of security, the ones that involve user
authentication, SQL injection and unauthorized
attempts to retrieve files.
The following security measures were
implemented:
338
1. MS Active Directory integration into the
LMS
2. Secure Socket Layer (SSL)
3. Custom roles using the Access Control List
(ACL) in the database
4. File System Security
3.1. MS Active Directory integration into
the LMS
User authentication on a multi-user system
should be easy and painless. For the LMS
implementation this part was left to the
Microsoft Active Directory.
On the system login form, the processing is
done on the server side using a .NET web service
that checks user credentials against the
University domain, and if successful, the user is
permitted to use the system.
As seen from Figure 1, the Active Directory
server is managed by the University’s IT Office
and this way the LMS Web Server has no need to
store any user credentials or user data on its own
server.
If a student or staff account is changed or
blocked on the Active Directory Server, he or
she will have those changes reflected to the LMS
system as well.
This integration allows the authentication part
to be done painless and no need for additional
users’ management is required by the LMS
application.
3.2. Secure Socket Layer (SSL)
Any form of user authentication on a web
browser is a potential flaw on the system due to
“the man-in-the-middle” phenomenon. In order
to secure data that is traveling on the LMS web
server, a Secure Socket Layer (SSL) with a 128
bit of encryption is installed on the same server.
This SSL enhances the security by encrypting
the credentials and other sensitive data traveling
from the user to the server and vice-versa. The
SSL is signed by a Certificate Authority, giving
more weight to the security than custom signed
Certificates.
3.3. Access Control List (ACL)
One of the most important steps in securing
the data and limiting the access is the custom
made Access Control List (ACL). ACL[2] is a
database driven control which defines roles
depending on the user level and specific recourse
on the LMS.
ACL defines four types of user levels, and as
such their permissions to the system:
1. System Administrator – level 1
2. Course Instructor – level 5
3. Teaching Assistant – level 10
4. Student – level 15
5. Everyone – level 20
A gap between user levels is intentionally
left, due to the fact that there might be an
introduction to another group of users (Example:
Foreign Students, Seminar Users). Those users
will probably need specific permissions, which
will need to be identified with another group of
users, such as Level 16.
The level number is given to a user by the
administrator, the Active Directory role or by the
Course Instructor. The lower the user level, the
higher the permissions to a specific course or
recourse are appointed.
This way of ACL, allows Course Instructors
to have more control over resources they create.
On one hand, a newly created folder or file, can
have its permissions set to “Teaching Assistants”
only, which will limit every user above level 10
to enter and see this content. On the other hand,
the same Course Instructor can appoint any user
to a Teaching Assistant level for his/her course.
Table 1. Role based Access Control List
Sample Data
Username Course GUID User Level
a.besimi 09b00c89-5fab- Instructor
47e3-80af-
332c7160af3d
a.besimi a4e96403-e26f- Instructor
4a11-97fb-
6b857f7a783a
a.besimi a4e96403-e26f- Teaching
4a11-97fb- Assistant
6b857f7a783a
The ACL is a Role-based ACL (Table 1),
and a role is appointed to a user for a specific
Course.
As seen from Table 1, a user can be
appointed to various roles for a given course, but
always the higher role of access will override the
lower role.
The ACL used in the solution not only limits
the listing of the content on the Web application,
but the download of that content as well.
339
3.4. File System Security
The ACL used in the solution not only limits
the listing of the content on the Web application,
but the download of the content as well.
Every time a user attempts to download some
content from the course, the content of that file is
streamed to the user. Before the streaming even
occurs, a check to the ACL for permissions is
done. If the user has access to the given content
(file), then the streaming will start.
File and Folder names on the file server
(Figure 1), are stored as globally unique
identifiers (GUID) [7]. The correct name,
description and permission level for that file or
folder are kept on the database and only a
reference to the newly created GUID is set.
By using this kind of file storage we are able
to:
• Allow duplicate file names and folders for
the same course
• Control the access to these files by streaming
the content instead of using the whole Query
string on the browsers address to do so.
Figure 2. File Storage tree structure using the
GUID
Creating duplicate file names is allowed,
since GUID (Figure 2) is unique for every entry
and this way an instructor can publish the content
(MyDocument.doc on January 12, 2009) and
again on the same folder, publish another
document with the same name, but different date.
This is useful when dealing with frequently
updatable files, such as updating grades, posting
new versions of documents and similar.
Retrieving files from the file server is
controlled by a library which accepts the GUID
(Figure 2) of the file as an input parameter, and
after checking for the permissions it streams
back the content. If a user by any means attempts
to access some other content than the one he/she
has access, then the user must have knowledge of
the GUID, which is a 22 characters long. Even in
this case a check against the ACL will be
performed. This attempt of “guessing” the files
GUID will be double checked which will ensure
extra security measure.
4. Social Engineering Training
“The recent tide of so-called phishing attacks
gives ample evidence that it is necessary to
include the human factor in security
modeling”[6].
We are discussing about attacks where the
victim is deceived to give out secret information
such as username and passwords.
The training of the users against the social
engineering attacks (phishing) is crucial. The aim
of this training was to ensure that users
understand what a domain is, what an identified
website is, and what could be a potential
phishing website. Improving public awareness of
these threats is a necessary component in
building a more secured system.
Previous phishing attacks on our University
network, sent by mail, gave results that were
concerning. Most of the staff members didn’t
really care about the URL appearing on the
address of the browser, neither the Website
Certificate which identifies the domain.
This way, we provided training on how to
identify the website where your credentials are to
be sent. The following steps are proposed to be
taken by users:
1. Always open the address manually, by typing
it on the browser
2. When opening the address directly from a
link inside the e-mail, check the URL on the
browser.
3. If the web page is opened, check for the
security certificate by checking the “https://”
in front of the URL.
4. Additionally, check for the Certificate to
ensure that a Certificate Authority identifies
your website correctly (Figure 3).
340
Figure 3. Website Identification using
certificates
A tutorial on these potential threats is posted
online on the main page, so users can go and
educate themselves.
We consider the social engineering attacks to
be a bigger threat to our system than different
network intrusions and this is why we propose
continuous training to our staff and students for
potential threats.
5. Conclusion
The three layers of security introduced on
this paper can be used as a model towards
development of similar complex systems on the
area of e-learning, as well as similar information
systems on other areas.
The security issues addressed here are
common when developing new Information
Systems. The success of e-systems will depends
on the security, due to the number of users in
large organizations.
The phenomenon of network intrusion, social
engineering and hacking will always be present
and the only thing that can be done is to try to
tighten the security not only by software and
hardware solutions, but by introducing additional
measures, such as physical security or “social
security”
6. References
[1] Abazi-Bexheti, L., Dika, Z. & Besimi, A.
(2008). In House Development of a
Learning Content Management System
Using Modular Approach. In Proceedings
of World Conference on Educational
Multimedia, Hypermedia and
Telecommunications 2008 (pp. 5915-5920).
Chesapeake, VA: AACE.
 [2] Bindiganavale, V.; Jinsong Ouyang, "Role
Based Access Control in Enterprise
Application ¿ Security Administration and
User Management," Information Reuse and
Integration, 2006 IEEE International
Conference on , vol., no., pp.111-116, 16-18
Sept. 2006.
[3] Chia-Chu Chiang,; Bayrak, Coskun,
"Modeling role-based access control using a
relational database tool," Information Reuse
and Integration, 2008. IRI 2008. IEEE
International Conference on , vol., no., pp.7-
10, 13-15 July 2008
[4] CISCO, Inc. Secure Use of VLANs: An
@stake Security Assessment [Report]. -
[s.l.] : @Stake, Inc., 2002.
[5] Fennelly Lawrence J. Effective Physical
Security [Book]. - [s.l.] : Elsevier Inc., 2004.
[6] Jakobsson M. Modeling and Preventing
Phishing Attacks. Phishing Panel in
Financial Cryptography '05 (FC'05). 2005
[7] P. Leach, M. Mealling, R. Salz, A
Universally Unique Identifier (UUID) URN
Namespace, July 2005.

341

View publication stats