This document discusses security considerations for the Moodle learning management system (LMS). It outlines how Moodle contains valuable user and course data that needs protection. An information security management system (ISMS) is crucial for applying security policies to identify protected assets, threats, vulnerabilities, and risks. Security involves securing the physical infrastructure that hosts Moodle, as well as technical measures within Moodle like access controls, encryption, authentication, and monitoring. Partnering with an experienced Moodle certified partner can help ensure a secure implementation.

1. Security in LMS Moodle
Ing. Libor Soška
Mgr. Michal Bajer
1

2. PragoData Consulting
We are the certificate Moodle partner
How we could help you with Moodle?
• Analytic and consulting services, solution design, project
management
• Graphics, Moodle template, responsive design
• Upgrade or unification Moodle for Schools
• Customization and extension development for peace
• System integration
• Training accredited by the Ministry of Education, creating
tailor-made courses
• Hosting, operation, user support, outsourcing Moodle
23. 5. 2016, EUNIS 2016 2PragoData Consulting, s.r.o.
www.moodlepartner.cz

3. Security in LMS Moodle
LMS Moodle
• One of the most widespread systems in the world LMS
• Application across organizations of various types
• It Contains valuable asset
• User data
• The progress and results of the study, stamps, badges
• Courses that contain high value
• Quiz bank
 Security threats, effort on disposal of assets
 The need to integrate Moodle in the ISMS
23. 5. 2016, EUNIS 2016 3PragoData Consulting, s.r.o.
www.moodlepartner.cz

4. Security in LMS Moodle
Information Security Management System (ISMS)
• Crucial for the application of security policy
within the organization
• Identification of assets that should be protected
• Identification of threats and vulnerabilities
• Assessment of the risk
• Impact analysis
• Design and implementation of measures
23. 5. 2016, EUNIS 2016 4PragoData Consulting, s.r.o.
www.moodlepartner.cz

5. Security in LMS Moodle
Levels of information security LMS Moodle
• IS security must be understood comprehensively
• Object security
• Safety operational infrastructure
• Security of LMS Moodle
23. 5. 2016, EUNIS 2016 5PragoData Consulting, s.r.o.
www.moodlepartner.cz

6. Security in LMS Moodle
Object security
• Independence of Moodle in operational
infrastructure
• Solutions of object´s security
• Location data centers outside the flood area
• Access system for authorization of persons
• Fire and extinguishing system
• Redundant power supplies, redundancy
• Dust-free, constant temperature and humidity zero rate
• Cooling system, backup cooling
23. 5. 2016, EUNIS 2016 6PragoData Consulting, s.r.o.
www.moodlepartner.cz

7. Security in LMS Moodle
Security of operationaly infrastructure
• LMS Moodle is multiplatform system
• The benefits of virtualization, not only in terms of
safety
• Backup
• Mostly non-critical system
• Incremental backups / full backups
• DB, Moodledata, source codes
• storing backups
23. 5. 2016, EUNIS 2016 7PragoData Consulting, s.r.o.
www.moodlepartner.cz

8. Security in LMS Moodle
Security in LMS Moodle
• Setting permissions on files and directories
• Moodledata directory must be accessible over the web
• Web server must not have the right to write to the
source directory
• Database accessible only from the localhost
• The server runs only the necessary services
• Updates, patches
• Access to stored files only through API
23. 5. 2016, EUNIS 2016 8PragoData Consulting, s.r.o.
www.moodlepartner.cz

9. Security in LMS Moodle
Security in LMS Moodle
• Actuality of system
• Lifecycle support period and version
• Every six months a new version, support for 12 months. +
6 months
• Encryption of communication
• Thin client – server => HTTPS
• Passwords security
• One-way function using the so-called salt (64 characters)
• Setting password strength rules
• The escalation of efforts to "guess" passwords
23. 5. 2016, EUNIS 2016 9PragoData Consulting, s.r.o.
www.moodlepartner.cz

10. Security in LMS Moodle
Security in LMS Moodle
• Authentication methods
• LDAP, MS AD, Shibboleth, RADIUS, CAS
• plugins for more-factor authentication
• SSO
• E.G. over AD - NTLM, Kerberos or Shibboleth
• Alternatively, custom development
• Protecting e-mail address
• Protect forms – Captcha
• In GUI Moodle assembly "Security Overview"
23. 5. 2016, EUNIS 2016 10PragoData Consulting, s.r.o.
www.moodlepartner.cz

11. Security in LMS Moodle
Monitoring
• Monitoring over IPS / IDS
• Monitoring of servers (Zabbix, Cacti, Nagios)
• Monitoring of user´s activity in LMS
Moodle
• Log of changes of Moodle settings
• Detail log of each access to Moodle
• Logs could be shown in different storage
23. 5. 2016, EUNIS 2016 11PragoData Consulting, s.r.o.
www.moodlepartner.cz

12. Why Moodle with PragoData?
• The benefits of Certified Partnership
• Strong and stable company with an experienced
team
• Experience with the development and
implementation of complex solutions (Oriflame -
more than 500 thousand users, VW SK, CSI, Vysocina
Region ...)
• Commitment to sustainability solutions
• Experience with integration with many other systems
• Synergistic use of the experience with other activities
PDC - consulting services and Web applications, Web
IS, web graphics and 3D animation
1223. 5. 2016, EUNIS 2016 PragoData Consulting, s.r.o.

13. Conference MoodleMoot.cz 2016
1323. 5. 2016, EUNIS 2016 PragoData Consulting, s.r.o.

14. Thank you for your attention
Ing. Libor Soška
libor.soska@pragodata.cz
www.moodlemoot.cz
www.moodlepartner.cz
www.pragodata.cz
14