| An institution that offers distance or correspondence education documents each of the following:
|
Judgment of Compliance
|
Narrative
Sam Houston State University (SHSU) ensures that the student who registers in a distance or correspondence education course or program is the same student who participates in and completes the course or program and receives the credit. Student identity is verified through use of a secure login and pass code, as well as by proctored examinations.
Secure Login and Pass Code
SHSU ensures the identity of students enrolled in distance and correspondence education courses through the use of a secure username and password. By utilizing the most up-to-date technologies and practices to verify online student identity, SHSU monitors and secures a student’s credentials from the moment they are initially established and continues through subsequent changes and scheduled password refreshers.
Upon acceptance to SHSU, students are provided an opportunity to activate an account [1], [2]. Acceptance into the university generates a communication sequence that permits students to access a secure university web portal, where they can establish their passwords according to strict security guidelines. As an added measure of security, students’ usernames are provided for them.
Special emphasis is placed on the importance of creating a secured, difficult-to-decode password, as well as the critical nature of safeguarding the username. SHSU students are presented such guidelines and recommendations in a variety of ways, including the dissemination of the User Accounts Password Policy: IT-02 [3], which establishes the confidentiality and strength expectations of the credentialing process and outlines the explicit responsibilities of the account holder.
Additionally, an FAQ webpage for password guidelines [4] is made available via the Computing Orientation [5]. The orientation is accompanied by tutorials in which students can access, download, and obtain instruction on various practices related to computer account activation and changing passwords. The tutorials are provided via the Technology Tutorials webpage [6]. Guidelines are also provided via an FAQ pop-up window [7] during the password creation and resetting process to promote the creation of hack-resistant passwords of sufficient length and strength.
Once students have activated their accounts, they are authorized to access the resources dictated by their role membership. For example, “student accounts will have access to appropriate campus file shares and email with designated quotas, appropriate file servers, personal website, wireless access, specific applications, and self-service functionality” [8].
SHSU continues to enforce the student’s use of the secure login and password to access all coursework for the duration of his/her academic time at the institution, as well as beyond graduation and into the alumni years. SHSU computer account passwords are valid for 180 days [9]. Students are required to change their passwords before the 180 days to retain access to their accounts. All inactive accounts (accounts not being accessed, such as not logging in to a workstation or checking email) will either be disabled or deleted (depending on the account type) after 180 days of inactivity.
MySam
The controlled student access mentioned above is managed and authenticated via MySam. MySam is the portal, or “front door,” to the Banner Student Information System (SIS) [10]. MySam allows authenticated users to access personalized content, university information, and secure systems, such as (a) Banner Self Service (BSS); (b) the academic advising and degree audit tool, DegreeWorks; and (c) the Learning Management System (LMS), Blackboard. MySam also allows access to other software programs peripheral to the academic experience, such as Microsoft Outlook for email.
Although MySam offers a robust component of identity management at the university, it is only one measure. MySam is supplemented by the institutional adoption and use of Central Authentication Service (CAS). CAS provides an additional layer of verification for credentialing and establishing student identity [11].
Central Authentication Service (CAS)
When a student attempts to log in to MySam, the authentication server redirects the request to CAS. CAS validates the student’s authenticity by checking his/her username and password against the institution’s Active Directory Database. When the authentication succeeds, CAS returns the student to MySam, passing along a security ticket. The application then validates the ticket and provides the application the trusted information about whether a particular user has been successfully authenticated.
The CAS protocol establishes and verifies stricter controls over user account verification. All SHSU CAS webpages are protected by an Extended Validation SSL Certificate. This level of certification is currently issued only to institutions that have undergone a more rigorous screening process to prove users’ identities.
Blackboard
SHSU distance education students completing online coursework do so through Blackboard, SHSU’s LMS. Access to Blackboard provides SHSU students right of entry and right to access courses for which they are registered. Blackboard courses contain lectures, discussions, assignments, examinations, and grades, as well as tool extensions for synchronous learning, web conferencing, group work, and student-to-student/student-to-instructor communication. Students can access content only for courses in which they are enrolled.
To verify the authenticity of the registered student, Blackboard uses MySam, which subsequently routes all access requests through CAS. CAS sends a credentialing ticket to its server to identify and authenticate users who attempt to access the Blackboard system with an SHSU username and corresponding password. Only authenticated users obtain access to the LMS.
Proctored Examinations
SHSU regularly scrutinizes common practices to ensure the identity of the online learner who are engaged in the completion of online coursework. One widely adopted and implemented methodology for supporting the institution’s stated expectations regarding student identification and authentication is test proctoring. The remote proctoring service, Tegrity, is made available to all online learners in all online course sections. Tegrity’s remote proctoring feature ensures the integrity of exams taken off-campus by recording video of: (a) the student’s government issued ID presented at the start of an exam, (b) the student taking the exam, and (c) the associated screen activity during the exam.
In addition, SHSU has licensed ProctorFree [12], an on-demand, automated online proctoring service that deters cheating in an online testing environment and provides student identity verification. Using biometric and machine learning technologies, this innovative technology leverages facial and voice recognition software for identity verification of distance education and correspondence students.
Tegrity and ProctorFree serve a critical purpose in the verification of student identity at SHSU. On the rare occasion in which a test calls for live proctoring conducted in a physical setting, alternatives to Tegrity and ProctorFree are afforded to the student and instructor by the DELTA Center. When distance education or correspondence students are asked to complete an examination in a physical setting, they have two options to verify their identity: a testing center in a local area or a public library agreement.
At times, a student might need to attend a physical testing lab for an examination. These official testing centers require students to present, prior to the exam, an original and current ID issued by a city, state, or federal government agency or the university. Electronic formats of identification in a physical lab are not acceptable. Additionally, the student’s first and last names must match the testing request submitted by the instructor and the photo on the ID must be clearly recognizable as the student entering the lab. Although SHSU does not offer a test proctoring service at any of its locations, distance and correspondence education students may use testing centers in their local areas.
Another methodology utilized by SHSU in assisting learners who require a physical testing setting is to connect the student with a public library in her/her geographical region that will proctor an exam. When this rare instance occurs, DELTA Center brokers conversations on behalf of the distance education learner and the public library in the student’s geographical region. Public libraries adhere to common test proctoring protocols regarding the verification of test takers’ identities, including the authentication of valid, government issued IDs.
Supporting Documentation