August 27, 2023

|

5 min read

Is Your Proctoring Solution a Security and Privacy Threat?

The US Department of Education's Privacy Technical Assistance Center has documented how data breaches and malware attacks have affected education systems across every sector. Most online proctoring services require browser extensions or plugins that create exactly the kind of installation-based malware vector that security researchers flag as high risk. This post examines the threat, what organizations should require from their proctoring vendors, and why a no-installation approach eliminates the risk at the source.

Privacy & Data Protection
Assessment Security
Caroline Esteves
Growth Marketing Specialist
Share
integrity-advocate-staging.webflow.io/resources/is-your-proctoring-solution-a-security-and-privacy-threat
Copy link
Woman working on a laptop at a home desk, with plants and natural light in the background.

The US Department of Education's Privacy Technical Assistance Center published a presentation titled Security Threats: Education Systems in the Crosshairs, in which security advisor Mike Tassey documented how data breaches, hacks, and privacy incidents have affected organizations across virtually every sector, from NASA and Citigroup to local school systems.

The warning is directly relevant to any organization using online proctoring. The data that proctoring services collect, including names, government-issued ID, biometric images, and session recordings, is exactly the kind of information that makes education systems a target.

The Threat Landscape Has Changed

Cyber-theft has become fully commoditized. There is an active black market for personal data, and an underground economy where over two million pieces of malware are built and sold every year. This malware is designed to gather precisely the kind of information proctoring platforms collect: Social Security numbers, addresses, birth dates, and identity credentials.

Tassey specifically noted that children's identities are particularly valued by data thieves because they are, in his words, fresh. A child's identity may go undetected for years before the theft is discovered, making it a high-value target for long-term fraud.

The alarming part is how malware typically gets onto devices. It is not usually through pirated software or poor security settings. It enters through plugins and browser extensions that users install themselves, often for legitimate purposes. The installation is the vector.

Why Proctoring Plugins Create Specific Risk

Most online proctoring services require users to install browser extensions or plugins to enable monitoring. Each of these installations represents an opportunity for malware to enter the device, either during the initial installation or through a subsequent update, without the user's knowledge or permission.

Tassey's research notes that on average there are one to five bugs for every 1,000 lines of code. For organizations that have not completed independent code reviews of the proctoring software they deploy, those bugs represent an unexamined attack surface. Malware can be introduced into code updates without detection, meaning a plugin that was clean at installation may not remain so.

At minimum, organizations should be instructing learners to disable or uninstall proctoring plugins and extensions immediately after use. The risk does not end when the exam does.

What a Code Review Should Cover

Organizations that require learners to install proctoring software should conduct, or require their vendor to provide evidence of, a code review that addresses:

  • Potential malware embedded in the plugin or extension code
  • Errors or vulnerabilities that could be exploited by third parties
  • Whether the software receives automatic updates, and what review process governs those updates
  • What data the software transmits, to where, and under what conditions

If a vendor cannot provide clear answers to these questions, the software should not be deployed on learner devices.

The Case for No-Installation Proctoring

The most effective way to eliminate installation-based security risk is to remove the installation requirement entirely. Integrity Advocate's platform is browser-based and requires no plugin, extension, or application installation in most cases. There is nothing to install, nothing running in the background after the session ends, and no update mechanism that could introduce malware without the user's knowledge.

For use cases that do require a lockdown browser, Integrity Advocate's solution uses fully open source code, does not accept automatic updates after installation, and does not transmit data beyond what is required for the session. The code is publicly available for inspection.

The US Department of Education's guidance on protecting student privacy points to the same principle: the safest data handling approach minimizes what is collected, minimizes how long it is retained, and minimizes the software footprint on learner devices.

{{post-cta}}

The Safest Proctoring Solution Is One That Doesn't Install Anything
Integrity Advocate requires no plugin or extension installation in most cases. No installation means no malware vector, no update risk, and no software left on learner devices after the session ends.

Book a demo today!

Let us walk you through how IA helps with scalable proctoring in 30 minutes.

Frequently asked questions

Find answers to the most commonly asked questions from our clients.

Browser extensions and plugins require installation on the learner's device, which creates an opportunity for malware to enter during installation or through subsequent updates. Security research cited by the US Department of Education's Privacy Technical Assistance Center indicates that there are one to five bugs for every 1,000 lines of code on average, meaning unreviewed proctoring software may contain vulnerabilities that can be exploited without the user's knowledge.

Malware can be embedded in the original plugin code or introduced through an automatic update pushed after installation. Because most users do not conduct code reviews of the software they install, and because updates often occur silently in the background, the malware may be present for an extended period before it is detected.

Security advisor Mike Tassey, in a presentation made available by the US Department of Education's Privacy Technical Assistance Center, noted that data thieves place particular value on children's identities because they are unused. A child's credit history is clean, and identity theft may go undetected for years, making it highly valuable for long-term fraud.

A code review is an independent examination of software code to identify bugs, vulnerabilities, and potential malware. For proctoring plugins and extensions, a code review should assess what data the software collects and transmits, whether automatic updates could introduce malicious code, and whether any existing vulnerabilities could be exploited by third parties. Organizations that deploy proctoring software without a code review are accepting an unexamined level of security risk.

Integrity Advocate's platform is browser-based and requires no plugin, extension, or application to run.