An information security reference framework for e-learning management systems

M.Sc. (Computer Science)Knowledge sharing technique has been revolutionized over the past years, and the use of Information and Communication Technologies (ICTs) is one of the main contributors to this revolution. One of the knowledge sharing means that emerged from the use of ICTs is the electronic Learning (e-Learning) system. An e-Learning Management System (e-LMS) is a software application that utilises ICTs to manage and deliver e-Learning to users. One of the main advantages of the e-LMS is unlimited access to information, including shared knowledge regardless of geographic location and time, which is the basis for its widespread popularity of e-LMSs in the academic and corporate environment. The main motivation behind this study is the realisation of the unique nature of e-LMSs, and its dependency on ICTs that makes it more vulnerable to information security risks; if these information security risks are not mitigated or put to an acceptable level, the overall integrity of the entire e-Learning process will be compromised. Moreover, in spite of the abundance of literature in e-Learning systems, the security aspect of e-LMS has been given very little consideration. This dissertation will investigate the possible information security risks facing e-LMSs from each user’s (i.e. Lecturers, Learners and Administrator) perspective. For the identified risks, as a possible information security counter measure, the author has created an information security reference framework, called ‘An Information Security Reference Framework for e-Learning Management Systems’ (ISRFe-LMS), which is based on the International Organization for Standardization’s (ISO) 27002. The ISO 27002 Standard is internationally accepted best practice for Information Security Management. Thus, the purpose of this dissertation is strictly focused on creating and enhancing the security of e-LMSs through the creation of the ISRFe-LMS. The Moodle e-LMS has been studied from its information security capabilities and mapped to the ISRFe-LMS, to validate how well it conforms to the security standards and criteria set by the ISRFe-LMS