Introduction

Relevance: The processes of informatization affected the development of educational technical systems. The usage of modern telecommunication technologies in the educational process made it possible to make learning as accessible, open, mobile and relevant as possible, for a significant part of society.

At the same time the learning process itself contributes to the development of new services and accomodations, and to the enhanced managerial, communication and information capabilities in the course of the performance of its tasks. Distance education technologies improvements allow to develop and disseminate educational information with use of distribution technologies [1,2,3,4].

The introduction of computer systems in education has led to a review of all technological components of the learning process. The visualization of thoughts, information and knowledge is now the basis for distance education. However, stable and quality access to system's resources and providing of large number of users' access without overloading telecommunications channels used, remain a key challenge.

The authors' task is an implementation of the proposed algorithms and organizational models of distance training programs in higher education, and remote access information security and management [5,6,7,8].

The object of the study is the information processes within University's structural unit responsible for distance learning.

The subject of the study is the development process of the information system, which is designed for information distribution, processing and protection in distance training programs in higher education.

Setting Goals

The following tasks were solved to achieve the goal of scientific research:

• an information infrastructure and the state of information security of a university that implements distance international educational programs have been analyzed; • a model and information security system for international educational programs have been developed; • a study on the activities of the university structural units implementing international educational programs has been carried out; • requirements for the developed information system for international educational programs were formulated; • a prototype of the information distribution, processing and protection system for international educational programs has been developed; • a system of organizational, technical and technological measures for international educational programs' information security has been developed [9,10,11,12].

Theoretical Research

In the course of their activities educational institutions use various information systems to process large amounts of data: the ones directly connected to the educational process as such and different types of sensitive data as well, for example, students and employees information (Figure 1). The process of distance learning includes theoretical training and practical work. Information technologies used in the process of distance learning organizing can be divided into three groups:

• technologies providing educational information; • technologies transferring educational information; • technologies processing and storing educational information.

Together they form distance learning technologies. The learning process is always based on the process of information transfer from the teacher to the student.

In an inherent traditional education model of full-time education, teacher (or professor) is the interpreter of knowledge. In distance education, the interpreter is a student himself. Because of that, educational information and its quality are subject to strict requirements.

Educational information should be collected with usage of the distribution technologies. Furthermore, educational information's distribution should provide students with remote access without the network load increasing.

Educational technologies in the technical field are characterized by the forward-looking nature of the development. For example, the introduction of computer technologies led to revised components of the learning process. Visualization of thoughts, information and knowledge become the basis for distance education [13,14,15,16,17].

Educational technologies used in distance education include:

• video lectures;

• interactive lectures and laboratory work;

• electronic textbooks;

• computer training and testing systems;

• simulation models and computer simulators;

• remote consultations and tests;

• video conferencing.

It is important in the educational process that the use of information technology helps to achieve educational goals. Learning outcomes depends on the quality of courses' development and provision.

The main role played by IT technologies in distance education is ensuring educational dialogue.

Communication technologies can be divided into two types -on-line and off-line. The first ones provide a real-time information exchange. Received messages are stored on the recipient's computer when using off-line technologies. The user can view them using special programs at a convenient time. Unlike full-time study where the dialogue is conducted only in real time (on-line), in distance education it might take place in delayed mode (off-line).

Network distance learning technologies could be particularly valuable in the joint degrees programs organization as they allow to implement the principle of educational recourses distribution.

Distance learning programs in higher education institutions are implemented in a specialized unit -the Institute of Distance Education. The Institute of Distance Education is an independent structural unit of the university, and report directly to the rector and vice-rector for academic affairs.

In general, the main tasks of the Institute of Distance Education are:

• distance education organizational and methodological support;

• university distance learning system software and hardware support, and its development;

• educational process organization and support;

• providing services for the distance education introduction.

To perform the above tasks, the Institute of Distance Education was entrusted with the following functions:

• provision of distance learning services; • provision of services for the introduction of new courses in the university distance education system; • provision of teacher training for distance education technologies.

Departments related to the Institute of Distance Education, as well as positions whose activities need automation, are shown in Figure 2.

It is necessary to have a good understanding of the organization of work within the Institute to develop a prototype of a current distance education information system. For this purpose, it is necessary to develop corresponding algorithms of interaction in BPMN notation. According to this notation, the process interaction diagram displays the main events, actions, and logical connections in the business process control flow. This notation is characterized by such components as: the start of a process; current events; notifications; rules; the end of a process. The interaction algorithm of the process "Organize work within the institute" is shown in Figure 3. In figure 3 following main elements of the business process are shown:

• data warehouse -elements of a future information system database (tables, list of equipment, curriculum, etc.); • start and end events;

• processes and tasks; • data objects -future forms of the information system client part prototypes (guidelines, plans of activities).

Below is an example of one of information system created for one of the institutes of distance education. This system involves collaboration with all types of data listed above (Figure 4). The authorial software products provide the lecturer with the opportunity to develop educational content based on visual programming: it would be sufficient to just add the necessary information. Components of educational content in the form of text fragments, illustrations or video are placed on the screen using manipulators. Content management systems allow creating and managing file directories of various types. Such distance education system is a database with a keyword search that allows a lecturer or methodologist to perform a quick search. Content management systems are especially applicable in cases where a large team of specialists is working on the courses creation and needs to use the same fragments of training materials in different training courses. This reduces the time spent on training programs development. Such distance education systems are ideal for web sites, educational programs and materials portals development.

Learning management systems provide the student with ample opportunities for creating an effective learning process, and provide learning process' manager with tools for creating training programs, monitoring, generating reports on learning outcomes, and organizing various options of communication between students and lecturers.

There are also learning content management systems (LCMS). Their basic difference from learning management systems is that they are aimed at managing the training programs' content and not directly at the educational process. Also they are intended to be used by training programs' developers, specialists in methodological support to courses, and heads of educational institutions.

The basis of learning content management system is the concept of representing an education content as a set of permanently engaged learning objects with certain attributes of usage. However, it is becoming increasingly difficult to draw a clear-cut line between two classes of systems. This is due to most of manufacturers of learning content management systems, which are using general learning management functionality. Many of the modern solutions of the category of learning management systems are similarly implementing the key features of educational content management.

However, it must be noted that any information systems, which are a technological base of distance learning systems, could be targets for various external and internal security threats, both malicious and accidental. That might impair not only distance learning process but also higher education institution functioning in general. In the conditions of increasing number of cybercrime, this factor entails need for organizing of the information security system [18,19,20,21]. Therefore, the scope of such security system is set not only by the university decision but also by the requirements of the information security regulating institutions, such as The Federal Service for Technical and Export Control of Russia, The Federal Security Service of the Russian Federation, The Federal Service for Supervision of Communications, Information Technology and Mass Media, etc.

Overview of System Security Assessment Methods

At present, there are numerous methods of information systems' assessing and protection. However, more generally they are universal and do not take into account the specificity of narrowly targeted systems and their use. In this regard the problem of ensuring the information security in the systems, which implement support for distance learning programs in higher education institutions, is of great importance nowadays. The solution to this problem is particularly important for international education programs, such as joint degrees programs and internships.

The overall picture of how risks affect the organization is shown in Figure 5. To date the main threats to the university information security are:

• malicious software (∼ 30%);

• human errors (∼ 20%);

• equipment failure (∼ 15%);

• information system penetration (∼ 5%);

• software failure (∼ 5%).

An information security of educational organizations should be constantly improved due to the permanent risk of information leaking. This process should be continuous and should involve improved methods and ways of information security systems improvement, continuous monitoring, system's weaknesses and potential information leakage channels identification. Continual improvement of such systems is strongly linked to the creation of new ways to gain an unauthorized access to a confidential and sensitive information.

The role of information security in the organizational system of safety measures is determined by the timeliness and accuracy of managerial decisions, taking into account available resources, information safeguards, and current laws and regulations.

Information security should serve as an integrated system in which all components are designed to prevent possible leakage of confidential information, and to protect information carriers from an authorized access. Thus, all of this ensures confidentiality, integrity and availability of information in dealing with it.

To date there are various information safeguards. These are legal, economic, technical, and organizational methods. Development of regulations and departmental regulations for ensuring information security refers to legal methods of information security.

Organizational, and organizational and technical methods may include:

• information security system development and improvement;

• information protection facilities development, improvement and usage, and facilities performance monitor; • dangerous to information, information resources, information systems hardware and software identification; • user's activity monitor; • information security monitoring system development.

The technical methods of information security ensuring may include:

• installation of security hardware and software ensuring protection from an authorized access, actions causing damaging impact on information system, destruction and distortion of information, unintended regular operation modifications; • identification of malicious hardware and software posing risk to means of processing and transferring information; • monitoring of technical means of transferring information, providing prevention of information leakage through technical channels; • technical supervision of technical measures' for information security effective functioning.

Economic methods include:

• introduction of the information security policy and its funding determining; • information systems improvement.

Modern information security is provided by the following methods:

• cryptographic information protection; • information management, both in a local networks and in communication channels; • monitoring and tamper detection; • ensuring information and software integrity; • introduction of enhanced means of restoring information security; • equipment and magnetic media physical protection and accounting; • formation of special information security services.

Namely, the use of cryptographic methods help to address the electronic information protection challenges. However, modern methods of cryptographic transformation retain an initial productivity of automated data-processing systems.

Usage of cryptography is the most effective way to ensure information confidentiality, integrity and availability. Cryptographic methods combined with technical and organizational methods provide with protection against a wide range of possible threats.

There are poor performance of the traditional security mechanisms and the backlog in the implementation of advanced methods of protection due to large data flows existence within educational institutions. In this regard, applications of the advances of cryptography call for special attention.

Thus, an employee responsible for the systems' security may seek guidance from standard GOST R ISO/IEC 27002-2012 for system's security self-assessment. According to that standard, it is recommended to carry out periodic conformity checks of the current level of security, required level, security policy, and technical requirements. However, the standard does not mention recommended methods for an implementation of checkups. Generally, an assessment procedure is performed by various interviewing techniques. This method is carried out in the following main stages:

• using questionnaires based on the requirements of the standard; • formation of knowledge base of scientific experts in line with the requirements and the recommendations of the standard; • formulating the guidelines for analysis of the replies to the questionnaires.

The application of the standardized approach only would allow to get a fast security assessment and to receive recommendations for a system being studied quite rapidly. However, the main drawback of such an approach is that the implementation of the recommendations received is nearly always difficult, if not impossible, because the standard does not take into account information collected by the system itself in its functioning. For that reason, in addition to the standard's requirements, specific features of the system, information assets and statistics on the threats to information security or information security incidents, collected in the system's functioning, is also to be considered.

Conclusion

Using the approaches described above is accessible in the development of new information security systems, as well as in examining security systems, which already exist in higher education institutions, including whose providing distance education technologies [22,23].