{"id":1171,"date":"2009-03-13T15:40:15","date_gmt":"2009-03-13T23:40:15","guid":{"rendered":"http:\/\/cubist.cs.washington.edu\/Security\/?p=1171"},"modified":"2009-03-13T15:40:15","modified_gmt":"2009-03-13T23:40:15","slug":"final-examinations","status":"publish","type":"post","link":"https:\/\/secblog.cs.washington.edu\/Security\/2009\/03\/13\/final-examinations\/","title":{"rendered":"Security Review: Final Examinations"},"content":{"rendered":"<p>Final exams are just around the corner (or in some cases may already have been taken if they&#8217;re in-class ones)!\u00a0 I figured I&#8217;d write a security review about the system of final exams.<\/p>\n<p><strong>Assets and Goals:<\/strong><\/p>\n<ul>\n<li>Pre-knowledge of questions<\/li>\n<li>After the fact, knowledge of other people&#8217;s grades<\/li>\n<li>During the test, forbidden knowledge<\/li>\n<li>During the test, having unauthorized person take test<\/li>\n<\/ul>\n<p><strong>Adversaries<\/strong>:<\/p>\n<ul>\n<li>Students are primarily the only adversaries.\u00a0 Sabotage by rival professors seems rather unlikely ;).<\/li>\n<li>Others may be interested for whatever reason in learning the score of a particular student on an exam.<\/li>\n<\/ul>\n<p><strong>Weaknesses:<\/strong><\/p>\n<ul>\n<li>Examinations may be handled by multiple locations prior to the test<\/li>\n<li>Professors may be lax about security<\/li>\n<li>Too-large class-sizes may overwhelm proctors from preventing cheating<\/li>\n<li>Lack of careful ID checking<\/li>\n<\/ul>\n<p><strong>Potential Defenses:<\/strong><\/p>\n<ul>\n<li>Provide one centralized location for professors to print out \/ copy their exams in advance, so that they do not run the risk of someone listening to network traffic or grabbing a copy off the copier.<\/li>\n<li>Ensure professors are familiar with security procedures to prevent students from sneaking into their offices.<\/li>\n<li>Ensure professors are given an adequate number of proctors to prevent cheating (plainclothes proctors, i.e., proctors who pretend they are students also taking the exam, can also be particularly effective as, although they cannot patrol such a large area, other students may be less wary about them noticing cheating)<\/li>\n<li>Have proctors check IDs of all students taking exams (I think I&#8217;ve had my ID checked a single time in 4 years, and many of those classes have been large lecture classes like Chem 142 where it&#8217;s doubtful the instructor recognized me)<\/li>\n<\/ul>\n<p><strong>Discussion and Conclusion:<\/strong><\/p>\n<p>There are many different types of cheating which students can do during an exam.\u00a0 First of all, we need to consider what allowance the exam has for outside notes.<\/p>\n<p>Particularly vulnerable to this is a class which is book only&#8211;I think I&#8217;ve only ever had one of those, but it&#8217;s extremely weak by default, as students can easily write in the margins of specific pages and as long as they are not stupidly blatant will not be caught.\u00a0 Solution: make everyone randomly swap books at the start of class.\u00a0 Weakness: time-consuming and difficult to ensure everyone gets their book back.\u00a0 Conclusion: book only exams are annoying to make work properly, better to allow book + notes or neither.<\/p>\n<p>Book + notes only is much easier to patrol.\u00a0 Essentially the only sources disallowed are electronic sources or other people.\u00a0 In this case, a sufficient number of proctors need to be around in order to ensure that students do not use cellphones (laptops are a little blatant for this). Solution: proctor numbers.\u00a0 Conclusion: relatively easy<\/p>\n<p>Book + notes + internet is quite difficult, as the laptop use must be monitored to prevent people from simply feeding the questions to a friend sitting at a computer at home who has already taken the class.\u00a0 As security people, of course, we know that you could monitor network traffic, but this is not very easy and requires specialist knowledge that most professors and proctors are going to lack.\u00a0 Easier is to just patrol the laptops, and require them all to sit in one location, at the front of the room.\u00a0 A few plainclothes proctors sitting near \/ behind them can be a great help here, as alt-tabbing when an obvious proctor is coming is quite easy, but they won&#8217;t know the person behind them &#8220;taking the exam&#8221; is watching their screen.\u00a0 Solution: plainclothes proctors.\u00a0 Conclusion: riskier, but doable<\/p>\n<p>No books\/notes\/internet is also pretty easy&#8211;visibility is key here.\u00a0 As long as a proctor can see people without too much effort, large areas can be patrolled, as looking at notes will often cause quite a bit of noise.\u00a0 Additionally, fellow students can easily identify and report the student who is cheating (emphasize the fact that the test is curved so they have a motive to do so \ud83d\ude42 )<\/p>\n<p>Overall conclusion: exams are rife with weaknesses.\u00a0 Some professors post grades online using the last digits of student ID #s as the index.\u00a0 Although these are not going to be unique, with knowledge of which classes a specific student is taking, accessing just a few of these classes will give an extremely high probability of figuring out which student it is.\u00a0 People glancing quickly at another students paper are another large risk (which can be minimized by ensuring spacious seating\/different versions of exams + non-multiple choice).<\/p>\n<p>The lack of security knowledge of many professors means it would be relatively simple to steal into their office during lunch (for example) and grab the graded finals.\u00a0 Doing this would also cause great chaos if the exams hadn&#8217;t been entered into the system yet, obviously, but even apart from that would violate the privacy of students to not have their grades plastered all over the internet.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Final exams are just around the corner (or in some cases may already have been taken if they&#8217;re in-class ones)!\u00a0 I figured I&#8217;d write a security review about the system of final exams. Assets and Goals: Pre-knowledge of questions After &hellip; <a href=\"https:\/\/secblog.cs.washington.edu\/Security\/2009\/03\/13\/final-examinations\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":119,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[],"class_list":["post-1171","post","type-post","status-publish","format-standard","hentry","category-security-reviews"],"_links":{"self":[{"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/posts\/1171","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/users\/119"}],"replies":[{"embeddable":true,"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/comments?post=1171"}],"version-history":[{"count":1,"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/posts\/1171\/revisions"}],"predecessor-version":[{"id":1176,"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/posts\/1171\/revisions\/1176"}],"wp:attachment":[{"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/media?parent=1171"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/categories?post=1171"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/tags?post=1171"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}