date. A number of software tools, that can be used in the organization of distance learning interaction via the Internet, has been studied in the paper. The tools have been analyzed against basic conditions of information security accreditation, such as a secure data transfer protocol, personal data transfer to a third party, cases of hacking, and sanctions restrictions to Information security risks of a teacher's digital tools have been evaluated taking into account the broad scope of the educational process and the number of its participants. The damage from the use of such tools has been related to the one from critical information infrastructure control objects. Information security, a teacher's digital tools, distance learning SLET-2020: International Scientific Conference on Innovative Approaches to the Application of Digital Technologies in Education, ORCID: 0000-0003-3807-5297 (Yuriy Sosnovskiy); 0000-0003-4165-5620 (Veronika Ilyina); 0000-0002-0429-8540 (Victor Milyukov)
The global economy is rapidly going digital. The patterns of interaction between economic and legal entities and, which is of utmost importance, educational institutions activities that can be converted into electronic format are also undergoing digital transformations. As a result, distance learning is becoming increasingly popular. Such distance form of educational interaction is cheaper for all the parties of the educational process, and there also appear more and more teacher’s digital tools (TDT) that facilitate such interaction.
saving the student's completed assignments and the grades [
free access to the curricula, work programs of the modules, internship and courses, as well as to educational publications in the electronic form and educational resources on the Internet;
2020 Copyright for this paper by its authors. recording of the educational process events and keeping track of the students’ progress in the course of mastering the educational curriculum; asynchronous and synchronous interaction between students and teachers.
Federal state standards for secondary education [
participants in the educational process is only stipulated for the educational programs that include electronic or distance learning forms of the educational process, which is not often common practice. But unfortunately, EIEE does not always have enough tools to meet all the needs of the educational process participants in terms of electronic interaction.
requirements of the regulatory authorities. At the same time, such limited tool set does not provide convenient instruments for communication and, as a result, progressive teachers have to look for their own methods of transmitting and distributing electronic educational materials, and to use the TDT that are more suitable for them.
BigBlueButton platform (BBB) is a free software system for web conferences. The major problem
with the system is that the BigBlueButton client works using the browser extension for Adobe Flash,
official support for which ends in 2020. Another disadvantage is relatively high pressure on the
server's computational capacity. The features of the BBB system are as follows [
3.2.
experimentally established that the optimal number of participants is up to 25-30 people. The maximum number allowed by the system is 50 people.
The system has some features particularly useful for the educational process: provides high-quality voice communication in the "General chat" mode. The minimum computer system requirements are reasonable, and there are modes both for automatically turning on the microphone and for using the dedicated button; allows you to arrange a streaming broadcast of the desktop screen or selected windows on your computer; it is possible to work both in the application and directly from the browser, which is convenient
has shown, it is advisable to introduce a local administrator of virtual servers and platform channels to correctly organize the interaction between the participants. The platform enables you to work effectively when active oral interaction is required both individually and in small groups – for practical work, collecting reports on laboratory work, and for lecturing in small groups. 3.3.
provides storage and seamless access to video contents; has convenient tools for analyzing users’ viewing, which allows you to identify fragments of lectures or videos that arouse the greatest interest in the audience; video materials can be distributed among the students and also in the public domain. 3.4.
work collaboratively on documents online in real time, work effectively on software codes and other materials, and also – in the areas that don't have ready-made solutions.
the features of the program, there is also holding online conferences, which though has a limit of 25 participants. At the same time, it should be noted that this program poses a potential threat to the information security of the user's computer due to the potential vulnerabilities of both the program and the need to open port 5938 for external access via TCP/UDP protocols.
many similar systems that use Adobe Flash technology for video transmission, ZOOM has implemented a real-time video content transmission technology — WebRTC (Web Real-Time Communication). You can set a password for the conference, invite participants by URL or email, and broadcast audio and images from your computer. There is a 40-minute limit on the length of the session for a free account.
It is also worth noting that in some regions, the use of this program without additional software is simply impossible due to various political issues and related restrictions. In addition, there is a significant number of instances when critical vulnerabilities were discovered in Zoom: for example, the MacOS user has to join a Zoom call with an activated video camera, what is more, there is no request for the authorization of switching on the camera; unauthorized connections to the broadcasts of strange people, password leaks, etc. 3.6.
feedbackб just as a teacher often does in a traditional classroom using a board or a smart- board. A teacher can arrange voice interaction via а convenient program, such as Discord, described above. And as to visualization, it can be effected through, for example, the AWWApp service. It does not require installation, you just need to go to the site, send your students an invitation to join the session, and work with the screen just as with a real board. In the graphics space you can make drawings, insert formulas, notes, etc. Due to the fact that the graphics space is shared, all participants can work in it at the same time. Accordingly, the teacher can give graphic tasks to the students and monitor their performance in the live mode.
3.7.
As an example, let us have a look at the Vkontakte network. It can be successfully used for distance learning under the condition that so-called "broadcasts" are arranged. The advantages of providing video content via social networks are the following: • students just need to click on the link to the broadcast, there is no need to download any special application; • the broadcast record is saved on the author's page and can be viewed at any convenient time; • the record can be viewed by all those who take interest in the subject, which is both a disadvantage if you need to limit the number of viewers, and an advantage if you want to share the information with a vast number of people.
3.8.
Basic criteria of TDT information security
Teacher’s Secure Personal data digital tool protocol transfer to a (TDT) third party Discord Yes end-to-end: TLS, DTLS, xsalsa20
Yes 2048-bit keys RSA and 256bit AES-by encrypting sessions
TLS * TLS
Yes
Yes, when registering an account
Yes, registration is required
No
YouTube TeamViewer
ZOOM
AWWApp, basic version Broadcasting in
VK Average Average Moderate Moderate Minimum
Known instances of hacking
Yes Leakage of
users’ passwords Leakage of
users’ passwords, hacking through TeamViewer
ID
Multiple
reports
about the
issues [
No No Yes Yes No TLS Yes, Average Leakage of No registration is users’
required** passwords * end-to-end encryption was declared. However, in practice, it is the usual TLS and a video stream is open to ZOOM servers
** Vkontakte is a Russian company. Website vk.com is listed in the register of information dissemination organizers under the number 4-PP, the date of its entry is September 4, 2014.
Features of storing and processing user data Teacher’s digital tools BugBlueButton (on your own servers) Discord
Compliance with regulatory documents on storage and processing of personal data
in information systems Yes, no client registration is required.
Use of cryptographic information security tools (CIST) with up-todate Federal Security
Service (FSS) certificates Technically possible
thousands only in the Russian Federation. In the context of restrictions related to the spread of
coronavirus, the requirements for the stability of services, as well as the requirements for compliance
with Russian legislation in the field of personal data processing, become important [
Unfortunately, in most cases, these standards are not met. Table 2 shows the technical features of
storing and processing user data, which according to [
I. Vernadsky University). Students are not required to register and submit their personal data – to get connected they follow a link; • AWWApp-interactive online whiteboard. Basic functionality (free illustrations, selection of tools, background loading of images and pdf-files, etc.) does not require registration for both teachers and students; • using the functionality of the social network Vkontakte. Registration and confirmation of the phone number are required. At the same time, Vkontakte places its servers on the territory of the
If the upper segment of the TDT (servers), communication channels, or lower-level devices (user devices) are affected by information and technical interference, there can occur a disruption of the educational process for some time. The examples of real problems that the participants of the educational process face are: • inability to connect to the broadcast streaming; • electronic services failure, lagging, etc.; • indirect threats related to the leakage or deliberate misuse of the user's personal data by the service.
critical, but the number of people involved in the process can be substantial and can significantly (a hundredfold or even thousands of times) surpass the number of those people who are negatively affected by misfunctions of the automated control systems, classified as critical information infrastructure (in the commonly used meaning of this definition).
frequency) of successful computer attacks (CA), that cause the transition of the system to a state of misfunction or failure (PCAi), and the notional value of damage from a single CA ( ), where i is the i index of the CA kind and the damage corresponding to it. Risk is most often understood as the product of the following parameters:
N (1) RCA PCA,i i ,
i1
methodology for assessing the risk, such as: RIA, HAZOP, HACCP, SWIFT, and others [
To be able to compare risks, their characteristics should be comparable. First, we are going to consider automated control systems (ACS) and the impact that computer attacks have on them. We are going to deal with the risks that do not lead to human death (in order to avoid interference with the moral issue). All the same, such risks do damage to the health of the people involved in the critical information infrastructure functioning. Financial damage, in this case, can be expressed as the sum of the money paid off to each sufferer ( NO ) to cover the costs of treatment ci , temporary loss of labour capacity di , moral, or non-pecuniary, damageUi , which, as has been said, can also be assessed in monetary terms, just as it happens in jurisprudence.
N0 (2) 0 ci di Ui ,
i1
Non-pecuniary damage may be translated into a financial equivalent with some margin of error . Similarly, the harm done to the reputation and risks of the disruption of teacher's digital tools functioning lead to a "moral damage" for state bodies and the system of education, since the number of people affected is extremely large. Consequently, such reputational risks can also be assessed in negative impact on the TDT is similar to (2):
NIS IS ci di Ui , i1 (3) where the majority of i: сi , di 0 , however NIS N . o
When comparing the damage magnitudes O and IS , it is possible to note the main difference, which is the following: NIS No . This leads us to the conclusion that in case of computer attacks on the information infrastructure used for educational purposes, the damage values O and IS , expressed in notional financial equivalent, are comparable in order of magnitude.
same time, in terms of their compliance with Russian legislation on personal data protection and from the standpoint of so-called "digital sovereignty", the choice is significantly narrowed down to several programs. The basic parameters of a teacher’s digital tools are presented in tables 1 and 2, but just a few of the products can be recommended.
relating to objects of critical information infrastructure (CII) O and the damage to an information system used for educational activities – a teacher's digital tool IS – are comparable in order of magnitude.