Fronter is Pearson’s commercial LMS; basically Moodle, but you pay lots of money for it. It quite possibly does more, but I’m not in a position to pay for a copy to find out. However, this isn’t a review of Fronter. In fact it applies to the concept of an LMS rather than Fronter, as an instance of an LMS.
An LMS (or LCMS) is a CMS that has been developed, or optimised for learning (hence the acronym). It’s currently being pushed in to primary schools for use by children as young as six, and it’s security is far from certain.
An LMS is also known as Virtual Learning Environments (VLE) in marketing-speak. Ask any academic computer scientist and they’ll tell you Moodle is the one to go for these days. WebCT in the past; but the open source nature and sheer power of Moodle makes it king of the castle – and it’s free. So why does half the world use Blackboard (they purchased WebCT in 2005)? My best guess is that most schools don’t have the technical ability to support anything in-house, and by outsourcing you get a commercial product, sold with smiles and soothing words. It’s just not realistic to expect many primary or secondary education institutions to have the knowledge to manage its own IT – the 20% of the world using Moodle are the clued-up tertiary sector. And the folks able to use Moodle are the same folks that are likely to understand the security implications. Primary schools are unlikely to have security skills in-house, and it’d be surprising to find that level of knowledge in a secondary (high) school either, so in order to use an LMS it has to be outsourced and made simpler.
Enter Pearson with Fronter. Pearson is a large media conglomerate with an education division, best known for brands such as Prentice Hall, Longman, Addison-Wesley. Ah, THAT Pearson. So you can see they’ve got a good ‘in’ to schools, and they appear to be pushing Fronter hard in to the primary sector. It’s being used for children as young as six, and this raises significant questions when it comes to security. Would you let your child use Facebook? Of course not; so why is Fronter, with its social media features any better?
Leaving aside whether it’s appropriate to introduce very young children to any form of social networking, a close look at the security aspects of any LMS is vital. Latterly I’ve been looking at Fronter, and this is used for examples in this article, but the comments apply to any LMS – they can all be configured in a dangerous way.
Fronter is obviously keen to allay concerns, and has just hired Logica (completed March 2010) to get it through ISO 27001. Fronter will doubtless wave this badge around saying “Okay – we’re now safe and secure to international standards”. This will be true, to at extent, but ISO-27001 is so vague it can mean anything. Like ISO-9000, it basically means it can be audited within the parameters set, and potential stakeholders can review the documentation and see if it meets their requirements. Even when these parameters are available, I doubt I’d be allowed to review it (Fronter – are you listening?)
Don’t get me wrong here. I’m not knocking ISO-27001 any more than I’d knock ISO-9000. At least not per se. It’s a framework, and as such, can be used to promote good or to conceal evil. Neither do I question Fronter’s commitment to keep intruders out of its system, if for no other reason than because any breach would have a disastrous effect on its business. I’m as confident as I can be that they’re taking the matter very seriously indeed, as do any other serious LMS developers.
But the developers can’t make an LMS safe. It’s infrastructure might be secure, but its users are always going to be the weak link. Schools really don’t know about who has access to their LMS, or don’t care because it’s too difficult a problem to find out.
When your child reads something posted by another Fronter user, who actually wrote it? Much is made of ensuring that everyone in contact with children has a CRB check, but a Fronter account for a child is given out to its parents with no checks made on them whatsoever.
Have you ever wondered what the likelihood of a randomly selected parent failing a CRB check might be? Well I reckon it’s about 1 in 5; in other words not much better than 50:50 that one adult in the house has a criminal record of some sort. (Figures aren’t compiled; I have extrapolated this from an answer in Hansard 25 Apr 2008 : Column 2328W). Worrying? So How many are likely to be on the “Sex Offenders Register”? Currently the English notification system lists 48,000 adults. It’s widely realised that most don’t appear on this because they haven’t been caught, and dodgy teenagers don’t figure in the stats at all, but certainly exist. Projecting this to working age parents (or guardians) you end up with an average of about three sex offenders being parents at a school of 1000 pupils. In other words, you can say pretty safely that there are probably registered sex offenders able to control accounts on most Infant and Junior schools using an LMS.
This leaves schools with a bit of a dilemma. If parents realised that they children were using a social media site shared by CRB failures and sex offenders they’d insist the plug was pulled. But at the very least, schools need to ask for informed consent from the parents before exposing their children to this risk – or turn off the ability to communicate in the LMS software (the safe option) and simply use it for staff to pupil communication. What schools often claim is that their staff monitor all content and messages. This will be done with the best of intentions, but will it be kept up long-term and how effective will it be on a large volume of traffic? If you’ve ever moderated a forum, you’ll understand the difficulty. However, teachers are smart people and usually have a sixth sense about where to watch for trouble.
Monitoring is undoubtedly good thing compared to a free-for-all, but does fail to address the fact that multiple channels are often used for nefarious purposes. A message posted on the LMS might seem innocuous in itself, but could easily be key part of an external conversation. Anyone who thinks children don’t routinely use code words adults won’t understand simply doesn’t know children.
So far I have considered login details falling in to the lap of undesirable elements via children in the household. But supposing an unconnected local paedophile wished to target a LMS directly. Is this possible? Of course, and here’s a scenario to make the point.
A fair number of schools now use outsourced emailing systems such as ParentMail, inTouch and CallParents to contact parents, and may simply use the mechanism to distribute attached files rather than proper text messages in the email body. Parents tend to trust emails from these services as they believe they know the sender (i.e. the their child’s school), and are conditioned into opening file attachments. It’s trivially easy to forge a ParentMail email, sending any file attachment the attacker pleases. Stealing login-in credentials in such circumstances would be almost child’s play, but if a key logger was too much trouble then a phishing email should work just as well. Assuming some effort is being made to target a child, an email to the parents saying “Please click here to log in to Fronter”, using context information from the school’s web site and parent details from Facebook is trivially easy. I haven’t heard of this happening, but I can’t believe it hasn’t.
Assuming the LMS developer has any sense of responsibility or desire to stay in business, it’s pretty clear that the security measures against infiltration of a LMS such as Fronter depend on policy rather than technology. If children are allowed to exchange messages with each other the only thing that will stop an infiltrator will be the vigilance of the monitoring staff. Supervision whilst using the system, whilst at home and at school, is just common sense. But there are still technical issues to address.
Some LMS require certain insecure features to be enabled on web browsers, such as Java. For security reasons, many people have risky technologies disabled. You certainly wouldn’t allow them in a secure commercial environment, so why take the risk at home? And worse, how much more of a risk is it if you allow a naïve child to use client-side code? Yet this is exactly what schools using an LMS are asking parents to do – drop the security on their home computers to allow access to attractive interactive features. There’s probably little risk that the LMS will contain compromised code unless pupils are allowed to develop their own content, but it’s not impossible especially using a targeted attack.
An LMS is an attractive vehicle for delivering malware for various reasons. In junior schools particularly, the inexperience of the pupils could allow things to be activated that adults would normally be suspicious of. Also, there’s a temptation for the institution to consider the LMS part of the Intranet and give it trusted status on local endpoints, meaning anything injected in to the LMS is likely to run with trusted privileges even when the Internet is locked down. This isn’t logical – if the endpoint is vulnerable to Internet-based web pages and LMS users can upload content, it’s not actually any more secure.
Many LMS allow file uploads for assignment submission, which provides a route to compromise the PCs used by the academic staff. Given that criminals will have access to some pupil’s login details by virtue of the fact they’re also parents, uploading a trojan to a staff computer is a real threat. For example, Fronter reassures users on its web site that uploads are scanned using Clam-AV. Commendable, but they are inadvertently giving the criminals the intelligence needed to bypass this specific scanner.
Another issue with file uploads concerns endpoint security software. If the endpoint has been secured, file transfers from the browser or elsewhere will be disabled. In order to use the LMS, this often has to be globally enabled. For example, using Ranger to block file upload/download dialogues with Fronter appears impossible because it uses the generic object selector. Ranger detects the window title and either blocks it or lets it through for every web site. Discrimination isn’t possible.
Whilst I’ve used Fronter in many of these examples because it is to hand, I am talking about general issues of security when allowing young children to use an LMS. The developers of such systems take good care to make sure the platform is inherently secure, but dangers remain from at least two sources. Firstly, there may be only a thin veneer of control over who has access to the system if pupils have access outside of school. Secondly, in order to run an LMS it is often necessary to disable endpoint security measures in such a way that it becomes venerable to threats from wider sources.
