Happy 2012. After writing a blog series outlining some of the major ed-tech trends of 2011 as well as a few obligatory posts with predictions for the new year, I figured I’d be off to the races, energized about my work as an education technology writer, excited for the potential for better teaching and learning opportunities facilitated by technology. But so far — and yes, I realize it’s only January 4 — it doesn’t feel like a terribly happy new year to me. There have been a string of ed-tech-related news stories over the last 4 days that have left me frustrated, if not depressed, about the year ahead.
Category: Ed Tech
The “Ed Tech” category includes posts about educational technology products themselves, including LMSs and other learning platforms, adaptive learning and other digital curricular materials products, learning analytics, and educational apps of all types. It also includes technical aspects of ed tech products, especially interoperability.
-
The Zone of Proximal Curiosity
Gardner Campbell has a great piece at Campus Technology that asks the following question:
What if we took another tack, specifying that students should not only remember information but also demonstrate increased curiosity?
I have enormous sympathy for this line of inquiry. In this post, I’m going to cover why I think it’s so important, how educating for curiosity interacts with other sorts of educational goals, and how we might begin to encourage it.
-
Protecting the Security of Student Data: Krebs v Rutgers, a case study
In 1992 seven students at Rutgers University sought federal court action to compel University administrators to protect their Social Security Numbers (SSN) from dissemination. The case became known as Krebs v Rutgers. It is often cited as guidance for what must be done to protect privacy from promiscuous use of SSN. The court record tells their story.
-
Educational Publishers Appear to be Supporting SOPA
UPDATE 12/23: Per the House Judiciary Committee, it is now confirmed that these companies are on the record supporting SOPA and the Protect IP companion legislation.
Yesterday the House Judiciary Committee began the process of marking up the Stop Online Piracy Act (SOPA) bill. From all appearances, most of the amendments have been rejected, thus leaving SOPA essentially in its original form. While passage is not assured, it is certainly a possibility as described by CNET.
After a marathon debate on the Stop Online Piracy Act, it’s clear that the Hollywood-backed bill enjoys enthusiastic support among key members of the U.S. House of Representatives and is one step closer to becoming law.
That became obvious after every legislative attempt to defang, rewrite, or significantly alter SOPA over nearly a 12-hour period today ended in victories for large copyright holders–and defeat upon defeat for the bill’s critics.
While the SOPA impacts are not fully understood, there are some real dangers to educational usage that we need to follow. As described in my first post on the subject, SOPA could have a major impact on institutions using any form of educational technology to share content outside of a tightly-controlled password-protected course site. As we saw at EDUCAUSE this year, much of the potential of educational technology is to facilitate sharing of content outside of the traditional “walled gardens” of traditional LMS solutions, and enabling collaboration more broadly.
This year’s EDUCAUSE keynote speaker, Seth Godin, has a post up at The Domino Project that calls out many of the list of “companies behind one of the lobbying groups pushing for SOPA”. On this list, lo and behold, we find most of the educational publishing companies.
Pearson Education, Cengage Learning, McGraw-Hill Education, Macmillan, Scholastic, etc. They are all on the list.
-
Instructure Security Assessment Results
Instructure has engaged Securus Global to test the Canvas LMS product for security vulnerabilities. Instructure has also invited me to be an independent observer – participating in the process and independently reporting on the testing and Instructure’s response to any vulnerabilities identified. Part 1 of this series of posts described the concept. Part 2 gave a mid-term update, describing the process involved and initial results. In this post I’ll describe the full results of the security assessment. I’ll add my actual analysis in the final post.
The purpose of the testing was to validate and review the Canvas LMS design and implementation with respect to vulnerabilities that could be exploited by a motivated hacker. Securus employed security experts to ethically hack, both manually and with automated tools, a test environment to try and identify specific vulnerabilities, working from the perspective of both an unauthorized user and an authorized user. There was a range of exploits tested, but the basic idea is to find out if someone could access information or functionality that should be protected by system controls including role-based security.
Summary of Findings
The findings were presented to Instructure on November 29, 2011 in report form and with a conference call to discuss.
-
Protecting the Security of Student Data: CollegeNet v XAP, A Case Study
In her blog “Law, Policy and IT” Tracy Mitrano expressed a concern: protecting student privacy as colleges and universities outsource information processing with external servicers. To ensure education records are protected, she writes, outsourcing contracts must explicitly detail the protection to be provided student data. She suggested contract provisions should require an entity comply with federal law including the Federal Education Rights Privacy Act. FERPA is one of the United States’ earliest public privacy laws enacted more than thirty years ago. She said “the Department of Education has already made clear that outsourcing these records does not alleviate the institution of its obligations under this law.” Her recommendation would build a “chain of responsibility” for the privacy and security of student education records. She observes these records have become “an important and permanent marker of an individual in a competitive society currently plagued by high unemployment rates even among college and professional school graduates in an era where corporations and firms routinely amass information from a variety of sources in the course of hiring.”
Student data have been disclosed and sold without permission by external vendors. One example is described in the court records of CollegeNet Inc. v XAP Corporation, U.S. District Court for the District of Oregon.
-
Instructure Security Mid-Term
Instructure has engaged Securus Global to test the Canvas LMS product for security vulnerabilities. Instructure has also invited me to be an independent observer – participating in the process and independently reporting on the testing and Instructure’s response to any vulnerabilities identified. Part 1 of this series of posts describes the concept. In this post, I’ll give a mid-term update, describing the process involved and initial results. In the next post I’ll describe the full results of the security testing. I’ll try to keep my actual analysis in the final post, after I have objectively described the process and results.
The purpose of the testing was to validate and review the Canvas LMS design and implementation with respect to vulnerabilities that could be exploited by a motivated hacker. Securus employed security experts to ethically hack a test environment to try and identify specific vulnerabilities, working from the perspective of both an unauthorized user and an authorized user. There was a range of exploits tested, but the basic idea is to find out if someone could access information or functionality that should be protected by system functionality including role-based security.
There are two particular viewpoints that have led to my interest in this independent observer role.
- No enterprise software platform is perfect and you should always expect some vulnerabilities. The issue should not just be on whether there are vulnerabilities, but perhaps more importantly, on how a company or organization responds to a security vulnerability or incident.
- I have called for transparency from LMS vendors and open source communities, arguing that they should share information from their third-party security audits and tests.