Presentation given by Elio Sancristobal from the Webinar series on IoT and new frontiers in education

1. SECURITY, DEVICES AND EDUCATION
ELIO SAN CRISTÓBAL
DIEECTQAI (ELECTRICAL AND COMPUTER ENGINEERING DEPARTMENT)
UNED (SPANISH UNIVERSITY FOR DISTANCE EDUCATION)

2. INDEX
• Introduction
• Concepts of security
• Risk analysis
• Security policies
• Conclusions

3. INTRODUCTION
Education 1.0
Education 2.0
Education 3.0
Education 4.0
Teacher-centred system
Education
2.0
Communication and collaboration
Student-centred system
New technologies and
rethinking the education

4. INTRODUCTION
• Technology (Software and hardware) is changing the education.

5. INTRODUCTION
• All these devices can be part of educational process. Displaying or/and
serving content or services. .
Content management systems
Learning management systems
Remote laboratories
Pocket labs

6. INTRODUCTION
• Other services are used by teacher and students. These services can be
integrated or not by Learning management systems or other learning
applications
E-mail
Storage services
Forums, chats…
Web servers

7. INTRODUCTION
• The exposure to attacks on educational devices and applications is much higher:
Physical file storages
PCs without connection
Connection everywhere
at any time

8. INTRODUCTION
Security is never 100%. There is always residual risk

9. CONCEPTS OF SECURITY
• The fundamental principles of information are three:
Confidentiality Integrity
Availability

10. CONCEPTS OF SECURITY
• Asset
• Vulnerability
• Threat
• Risk
Asset
Vulnerability: Default passwords
Threat: Access NOT authorized
Risk = Probability access not
authorized X impact of this access

11. RISK ANALYSIS
1. Asset evaluation
• Identification of assets
• Description of each asset
• Type (physical, application software, data, or end user services )
• Asset valuation, Relationship among assets, …

12. RISK ANALYSIS
Asset evaluation à simple example
Login page courses (ID 15)
This is the login page of YYY. Version
2.5
Software asset
Personal information of students,
credentials à Personal student
information, Evaluation data, ……..
Server Machine (ID 2) à Hardware
web server (ID 3) à software
Database (ID 4) à software
………………..

13. RISK ANALYSIS
2. Identifying and assessing the relevant threats to each asset
• Eavesdropping
• Unauthorized access to the information system
• Compromising confidential information
• Software errors
• Social engineering

14. RISK ANALYSIS
Identifying and assessing threat
Threat: Damage the devices
Threat: Software errors
Threat: Unauthorized access
Threat: Compromising confidential information

15. RISK ANALYSIS
3. Identifying and assessing of safeguards à Protecting asset from threats
• The safeguards have a cost higher than the impact of the thread on the asset.
• The safeguards is easy to implement and the cost is lower than the impact the threat on
the asset .

16. RISK ANALYSIS
4. Risk estimation Risk Assessment Matrix
Probability
IMPACT
High
Medium
Low
Low Medium High
Low Low
Low
Medium
Medium
Medium
High
High High

17. RISK ANALYSIS
• Risk Assessment Matrix
Probability
IMPACT
High
Medium
Low
Low Medium High
Low Low
Low
Medium
Medium
Medium
High
High High
Threat: Damage the devices.
If the devices is located at
an Area where people can
access easily
Threat: Unauthorized access.
If there are strong passwords
mechanism and the
information of system is
public

18. SECURITY POLITICS
• Set of rules that all people who have access to any information and / or
technology of an organization must fulfill.
• being able to be implemented
• being understood by all the members of the organization or institution
• being fulfilled by all the members of the organization or institution
• should allow normal work

19. SECURITY POLITICS
• Some examples of security polices
• Password policies
Strong passwords
Do not use default passwords
mechanisms to request a
password change
……

20. SECURITY POLITICS
• Update policies
• Determining what software should be updated
• Registering the updates
• Setting up an alarm system to update the applications

21. SECURITY POLITICS
• Email policies
• Installing antimalware and antispam systems
• Analyzing of attached files
• Checking links in the mails

22. CONCLUSIONS
• Technology and education go hand in hand
• From isolated system to set of educational applications which work together
• All these applications and networks communication have increased the attack
surface.

23. CONCLUSIONS
• Schools, Universities must be aware of the risks of opening their services
abroad and stablish safeguards
• Professors, Teachers, Tutors, students must make good use of technology
(Security policies)

24. CONCLUSIONS
• IEEE educational society is aware of the importance of safe educational
systems and is working on the standard for Secure and Trusted Learning
Systems

25. Thanks for you attention