Why cyber security matters in digital assessment
October is Cyber Security Awareness Month. This is a global initiative to raise awareness of online safety and encourage organisations and individuals to protect themselves against cybercrime. This year’s theme, Don’t Make It Easy for Them, highlights how everyday security measures can make life more difficult for cybercriminals.
This is particularly relevant when choosing exam software. While functionality and usability matter, they need to be considered alongside the security measures in place to protect sensitive assessment data.
Assessment platforms can handle large amounts of sensitive data. From student information, exam questions, performance statistics to results. Unauthorised access or a data breach could have serious consequences. Which could affect confidentiality, compromise exam integrity, undermine confidence in results and damage the institution’s reputation.
As cyberattacks become increasingly sophisticated, it’s vital that system security is central to the decision-making process when selecting an exam platform, and not an afterthought once the system is implemented.
What should institutions look for in an assessment software provider?
First and foremost, it’s important to choose a partner with a strong track record of supporting institutions in delivering secure examinations. When evaluating potential providers, consider the following:
- Supplier security assurance.
What evidence can a provider offer of its commitment to cyber security? Do they have independent certification? This can help institutions assess how seriously the provider approaches protecting its systems.
- Authentication and access control.
How does the software control who can access assessment materials and system functions? Different users have different responsibilities. For example, exam authors, exam administrators and examiners don’t need the same level of access, so appropriate permissions and authentication arrangements are important.
- Accountability and traceability.
Are audit trails available to help institutions review relevant system activity? Being able to trace relevant actions can help assessment teams investigate unexpected changes, understand how assessment materials or results have been handled, and support accountability.
How Speedwell approaches security with the eSystem exam software
Independent testing
We recognise the importance of security and our responsibility to provide assurance to our customers. That’s why we hold Cyber Essentials Plus certification. This demonstrates our commitment to maintaining appropriate cyber security measures. The UK Government-backed scheme includes independent technical testing to verify that relevant security controls are in place.
The eSystem also undergoes independent third-party penetration testing annually to identify potential vulnerabilities and assess how well the software stands up to attempted cyberattacks. The most recent testing identified no critical or high-severity issues.
System safeguards
The eSystem uses encryption to protect data both when it is transmitted and when it’s stored, with a unique encryption key for each customer. Each customer has their own application environment, database and storage, keeping their data separate from that of other customers. For customers who choose to host with us, data and backups are held in the AWS region closest to the institution.
Hosted eSystem instances are backed up automatically each night, with backups encrypted and stored separately from the live system. Backups are protected against destruction, helping safeguard recovery options if the live system or its data are compromised. Backup monitoring alerts are in place if a backup fails, helping us proactively identify issues and maintain the availability of backup data.
Our approaches to encryption and backup protection are informed by guidance from the National Cyber Security Centre (NCSC).
Alongside these measures, the eSystem supports integration with institutional authentication arrangements through single sign-on (SSO) and LDAP. This helps institutions manage user access in line with their existing systems.
The eSystem’s granular permissions mean access can be tailored to each role. For example, question authors can access their question bank without seeing statistics or results. Examiners can only access the exams they have been allocated to mark. This ensures sensitive assessment information is only accessible to those who need it. This reduces the risk of unauthorised access and supports the integrity and confidentiality of examinations.
Audit trails provide an additional layer of visibility by recording system activity. These records can be reviewed to help assessment teams investigate unexpected changes, establish what has happened within the system and maintain transparency around assessment activity.
Together, these measures give greater control over access to assessment information and greater visibility of activity within the system. Helping protect the confidentiality and integrity of examinations.
Choosing an assessment technology partner
Ultimately, it’s important to choose a supplier that understands the institution’s requirements and can support the security protocols already in place, such as MFA and SSO. Independent accreditation can provide an additional layer of reassurance. Helping institutions make a more informed decision when choosing an assessment technology provider.
Get in touch
If you would like to find out more about our eSystem exam management software and how it could support your institution’s assessment needs, contact us. Alternatively, call our sales team on +44 (0) 1223 851703 to arrange a no-obligation demonstration.
