Scope and Context

Use Cases

Most schools, districts and institutions struggle to ensure that their teachers and students are using approved digital resources in the classroom and online. A number of schools and institutions have put in place a process for faculty or teachers to make a request for approval of a digital resource. The subsequent evaluation processes are often too long and inefficient to accommodate faculty or teacher’s “On Demand” needs, in time for their upcoming classes. The 1EdTech TrustEd Apps Security Practices Rubric can supplement these evaluation processes by allowing instructors and staff to get a quick snapshot view of an app's security, providing confidence that the chosen app aligns with the basic requirements for security. Evaluation authorities themselves can use the rubric to get an understanding of a tool's security posture to better know how long it will take them to move through their institutional review process. This also reduces demands on IT and procurement, allowing staff to focus attention on the most promising applications that have the desired security profile or be more realistic when determining a timeframe for implementation

This app vetting rubric also benefits Ed-tech suppliers by helping them avoid countless requests from multiple schools, districts, and institutions for the kind of information that the rubric is meant to address. Without this rubric, suppliers have to commit scarce resources to answer questionnaires, addressing issues very similar to those raised by others. Via the app vetting process, suppliers submit information to 1Edtech using the rubric that is then published for institutional viewing and feedback process. This process promises to ease the supplier's burden of communication allowing them to focus their resources on improving their software and services. The alignment of this rubric with EDUCAUSE’s HECVAT also enables suppliers to easily transfer their answers between the two rubrics. This rubric can also inform Ed-tech suppliers of typical institutional requirements for integration into their digital learning environment.

Structure of This Document

The structure of the rest of this document is:

Security App Vetting Vocabulary/Terminology

• Access Control - The process of granting or denying specific requests to 1) obtain and use information and related information processing services and 2) enter specific physical facilities (e.g., federal buildings, military establishments, border crossing entrances). https://csrc.nist.gov/glossary/term/at

• Attribute Based Access Control (ABAC) - An access control approach in which access is mediated based on attributes associated with subjects (requesters) and the objects to be accessed. Each object and subject has a set of associated attributes, such as location, time of creation, access rights, etc. Access to an object is authorized or denied depending upon whether the required (e.g., policy-defined) correlation can be made between the attributes of that object and of the requesting subject. https://csrc.nist.gov/glossary/term/at

• At-Rest - The encryption of the data that is stored in the databases and is not moving through networks. https://www.ibm.com/docs/en/strategicsm/10.1.3?topic=security-data-rest-encryption

• Authentication - Verifying the identity of a user, process, or device, often as a prerequisite to allowing access to resources in an information system. https://csrc.nist.gov/glossary/term/authentication

• Auto Provision - The ability to deploy information technology or telecommunications services using predefined automated procedures without requiring human interventions. https://www.ericsson.com/en/blog/2019/8/why-is-automated-provisioning-so-important

• Automated Intrusion Detection System (IDS) - A security service that monitors and analyzes network or system events for the purpose of finding, and providing real-time or near real-time warning of, attempts to access system resources in an unauthorized manner. https://csrc.nist.gov/glossary/term/intrusion_detection_system

• Automated Intrusion Prevention System (IPS) - A system that can detect an intrusive activity and can also attempt to stop the activity, ideally before it reaches its targets. https://csrc.nist.gov/glossary/term/intrusion_prevention_system

• Breach - The loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where: a person other than an authorized user accesses or potentially accesses personally identifiable information; or an authorized user accesses personally identifiable information for another than authorized purpose. https://csrc.nist.gov/glossary/term/breach

• Change Management Process (CMP) - A systematic approach to dealing with the transition or transformation of an organization's goals, processes or technologies. The purpose of change management is to implement strategies for effecting change, controlling change and helping people to adapt to change. https://www.techtarget.com/searchcio/definition/change-management

• CIS Controls - A recommended set of cybersecurity best practices and defensive actions that provide specific and actionable ways to thwart the most pervasive attacks and support compliance in a multiframework environment. https://www.unitrends.com/blog/cis-controls

• Cloud Service - Any IT services that are provisioned and accessed from a cloud computing provider. This is a broad term that incorporates all delivery and service models of cloud computing and related solutions. Cloud services are delivered over the internet and accessible globally from the internet. https://www.techopedia.com/definition/29017/cloud-services

• Cyber-Risk Insurance - also referred to as cyber liability insurance coverage (CLIC), is a policy with an insurance carrier to mitigate risk exposure by offsetting costs involved with damages and recovery after a cyber-related security breach or similar event. https://www.csoonline.com/article/3643054/cyber-insurance-explained.html

• Cybersecurity Framework - A layered structure indicating what kind of programs can or should be built and how they would interrelate. Some computer system frameworks also include actual programs, specify programming interfaces, or offer programming tools for using the frameworks. A framework may be for a set of functions within a system and how they interrelate; the layers of an operating system; the layers of an application subsystem; how communication should be standardized at some level of a network; and so forth. A framework is generally more comprehensive than a protocol and more prescriptive than a structure. https://csrc.nist.gov/glossary/term/framework

• Data Encryption - translates data into another form, or code, so that only people with access to a secret key (formally called a decryption key) or password can read it. https://www.digitalguardian.com/blog/what-data-encryption

• Data in Transport - The part of the service related to communication lines from and to the Provider’s Data Center, the Customer’s offices and from or to the Internet also while mobile. https://www.lawinsider.com/dictionary/data-transport

• Data Input Validation - Confirmation (through the provision of strong, sound, objective evidence) that requirements for a specific intended use or application have been fulfilled (e.g., a trustworthy credential has been presented, or data or information has been formatted in accordance with a defined set of rules, or a specific process has demonstrated that an entity under consideration meets, in all respects, its defined attributes or requirements). https://csrc.nist.gov/glossary/term/validation

• Data Sanitization - Process to remove information from media such that information recovery is not possible. It includes removing all labels, markings, and activity logs. https://csrc.nist.gov/glossary/term/sanitization

• Data Separation (Logical) - Separating and storing data in separate logical partitions or storage areas, even if those partitions or storage are on the same physical device. This can be much more cost effective than physical segregation and allows organizations much more flexibility in designing and implementing data access policies. Because all data is physically on the same system, changing data access policies or who can access specific data sets can be done by modifying the logical rules, instead of physically moving data, or changing who has physical access to the systems. https://www.nextlabs.com/what-is-data-segregation/

• Data Separation (Physical) - Separating and storing data on different physical systems or networks. While this may prevent someone from accessing the data if they don’t have physical access to the systems where it is stored, it also requires the expense of setting up different systems for the data sets that need to be segregated. Data storage regulations may require physical segregation, however, especially in the case where data is not allowed to leave a country’s borders or there are restrictions on sending data to certain countries. By implementing physical separation, organizations can comply with export regulations of this nature. https://www.nextlabs.com/what-is-data-segregation/

• DevSecOps - DevSecOps stands for development, security, and operations. It's an approach to culture, automation, and platform design that integrates security as a shared responsibility throughout the entire IT lifecycle. https://www.redhat.com/en/topics/devops/what-is-devsecops

• Disaster Recovery Plan (DRP) - A written plan for processing critical applications in the event of a major hardware or software failure or destruction of facilities. https://csrc.nist.gov/glossary/term/disaster_recovery_plan

• End User - the ultimate consumer of a finished product. https://www.merriam-webster.com/dictionary/end%20user

• End-of-Life (EOL) - The OEM will no longer market, sell, or update your equipment after a certain date. https://serviceexpress.com/resources/eol-eosl-tip-sheet/

• External Audit - Independent review and examination of records and activities to assess the adequacy of system controls, to ensure compliance with established policies and operational procedures. https://csrc.nist.gov/glossary/term/audit

• Higher Education Community Vendor Assessment Toolkit (HECVAT) - a questionnaire framework specifically designed for higher education to measure vendor risk. Before you purchase a third-party solution, ask the solution provider to complete a HECVAT tool to confirm that information, data, and cybersecurity policies are in place to protect your sensitive institutional information and constituents' PII. https://library.educause.edu/resources/2020/4/higher-education-community-vendor-assessment-toolkit

• Hosting Provider - A type of IT service provider that provisions and serves a pool of remote, Internet-based IT resources to individuals and organizations for hosting their websites. A hosting service provider delivers hardware, software, storage, network and/or their combined solutions to enable Web hosting services. https://www.techopedia.com/definition/137/hosting-services-provider-hsp

• Infrastructure as a Service (IaaS) - The capability provided to the consumer is to provision processing, storage, networks, and other fundamental computing resources where the consumer is able to deploy and run arbitrary software, which can include operating systems and applications. The consumer does not manage or control the underlying cloud infrastructure but has control over operating systems, storage, and deployed applications; and possibly limited control of select networking components (e.g., host firewalls). https://csrc.nist.gov/glossary/term/infrastructure_as_a_service

• Incident Response Plan - The documentation of a predetermined set of instructions or procedures to detect, respond to, and limit consequences of a malicious cyber attacks against an organization’s information systems(s). https://csrc.nist.gov/glossary/term/incident_response_plan

• Information Security - The protection of information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide confidentiality, integrity, and availability. https://csrc.nist.gov/glossary/term/information_security

• Information Security Principles - Confidentiality, integrity, and availability (CIA) are the core information security principles. Together, these three principles are read as the CIA triad. These three principles help maintain the core requirement of InfoSec for the safe storage, utilization, and transmission of information. https://emeritus.org/in/learn/information-security-and-its-principles/

• Internal Incident Response Team - An incident response team, also called an incident response unit, is a group responsible for planning for and responding to IT incidents, including cyber attacks, systems failures, and data breaches. https://www.cynet.com/incident-response/incident-response-team-a-blueprint-for-success/

• Intrusion Detection System (IDS) - IDSs which detect attacks by capturing and analyzing network packets. Listening on a network segment or switch, one network-based IDS can monitor the network traffic affecting multiple hosts that are connected to the network segment. https://csrc.nist.gov/glossary/term/intrusion_detection_system

• Intrusion Prevention System (IPS) - Intrusion Prevention System: Software that has all the capabilities of an intrusion detection system and can also attempt to stop possible incidents. https://csrc.nist.gov/glossary/term/intrusion_prevention_system

• ISO 27001 - ISO/IEC 27001 is the international standard for information security. It sets out the specification for an effective ISMS (information security management system). ISO 27001's best-practice approach helps organisations manage their information security by addressing people, processes and technology. https://www.itgovernance.co.uk/iso27001

• Media Handling Process - To Stop unauthorized release, alteration, deletion, or destruction of information contained in the media. https://info-savvy.com/iso-27001-annex-a-8-3-media-handling/

• MFA - An authentication system that requires more than one distinct authentication factor for successful authentication. Multifactor authentication can be performed using a multifactor authenticator or by a combination of authenticators that provide different factors. The three authentication factors are something you know, something you have, and something you are. https://csrc.nist.gov/glossary/term/mfa

• National Institute of Standards and Technology (NIST) - The NIST Cybersecurity Framework helps businesses of all sizes better understand, manage, and reduce their cybersecurity risk and protect their networks and data. The Framework is voluntary. https://www.ftc.gov/business-guidance/small-businesses/cybersecurity/nist-framework

• Open Worldwide Application Security Project® (OWASP) - A nonprofit foundation that works to improve the security of software. Through community-led open-source software projects, hundreds of local chapters worldwide, tens of thousands of members, and leading educational and training conferences, the OWASP Foundation is the source for developers and technologists to secure the web. https://owasp.org/

• Platform as a Service (PaaS) - The capability provided to the consumer is to deploy onto the cloud infrastructure consumer-created or acquired applications created using programming languages, libraries, services, and tools supported by the provider. The consumer does not manage or control the underlying cloud infrastructure including network, servers, operating systems, or storage, but has control over the deployed applications and possibly configuration settings for the application-hosting environment. https://csrc.nist.gov/glossary/term/platform_as_a_service

• Policy Based Access Control (PBAC) - A strategy for managing user access to one or more systems, where the business roles of users is combined with policies to determine what access privileges users of each role should have. Theoretical privileges are compared to actual privileges, and differences are automatically applied. For example, a role may be defined for a manager. Specific types of accounts on the single sign-on server, Web server, and database management system may be attached to this role. Appropriate users are then attached to this role. https://csrc.nist.gov/glossary/term/policy_based_access_control

• Payment Card Industry Data Security Standard (PCIDSS) - An information security standard administered by the Payment Card Industry Security Standards Council that is for organizations that handle branded credit cards from the major card schemes. https://csrc.nist.gov/glossary/term/pci_dss

• Product Lifecycle - The length of time from a product first being introduced to consumers until it is removed from the market. A product’s life cycle is usually broken down into four stages; introduction, growth, maturity, and decline. https://www.twi-global.com/technical-knowledge/faqs/what-is-a-product-life-cycle

• Product Management - An organizational function that guides every step of a product’s lifecycle — from development to positioning and pricing — by focusing on the product and its customers first and foremost. To build the best possible product, product managers advocate for customers within the organization and make sure the voice of the market is heard and heeded. https://www.atlassian.com/agile/product-management

• Role Based Access Control - Access control based on user roles (i.e., a collection of access authorizations a user receives based on an explicit or implicit assumption of a given role). Role permissions may be inherited through a role hierarchy and typically reflect the permissions needed to perform defined functions within an organization. A given role may apply to a single individual or to several individuals. https://csrc.nist.gov/glossary/term/role_based_access_control

• Software as a Service (SaaS) - The capability provided to the consumer is to use the provider’s applications running on a cloud infrastructure. The applications are accessible from various client devices through either a thin client interface, such as a web browser (e.g., web-based email), or a program interface. The consumer does not manage or control the underlying cloud infrastructure including network, servers, operating systems, storage, or even individual application capabilities, with the possible exception of limited user-specific application configuration settings. https://csrc.nist.gov/glossary/term/software_as_a_service

• Security Assessment - The testing and/or evaluation of the management, operational, and technical security controls in an information system to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements for the system. https://csrc.nist.gov/glossary/term/security_assessment

• Security Framework - A compilation of state-mandated and international cybersecurity policies and processes to protect critical infrastructure. It includes precise instructions for companies to handle the personal information stored in systems to ensure their decreased vulnerability to security-related risks. https://www.techslang.com/definition/what-is-a-security-framework/

• Security Posture - The security status of an enterprise’s networks, information, and systems based on information security resources (e.g., people, hardware, software, policies) and capabilities in place to manage the defense of the enterprise and to react as the situation changes. https://csrc.nist.gov/glossary/term/security_posture

• SOC 2 - SOC 2 is a voluntary compliance standard for service organizations, developed by the American Institute of CPAs (AICPA), which specifies how organizations should manage customer data. https://www.checkpoint.com/cyber-hub/cyber-security/what-is-soc-2-compliance/

• Software - Computer programs and data stored in hardware - typically in read-only memory (ROM) or programmable read-only memory (PROM) - such that the programs and data cannot be dynamically written or modified during execution of the programs. https://csrc.nist.gov/glossary/term/software

• Source IP Address - The IP address of the outgoing switch interface on which the client is communicating with the server. https://www.arubanetworks.com/techdocs/AOS-CX/10.10/HTML/fundamentals_83xx-10000/Content/Chp_IfaceCfg/sin-sou-ip-add-10.htm

• Single Sign-On (SSO) - Is an identification method that enables users to log in to multiple applications and websites with one set of credentials. SSO streamlines the authentication process for users. It takes place when a user logs in to an application and is automatically signed in to other connected applications, regardless of the domain, platform, or technology they are using. This eases the management of multiple usernames and passwords across various accounts and services. https://www.fortinet.com/resources/cyberglossary/single-sign-on

• Stateful Packet Inspection Firewall (SPI) - Packet filtering that also tracks the state of connections and blocks packets that deviate from the expected state. https://csrc.nist.gov/glossary/term/stateful_inspection Static Application Security Testing - Static application security testing (SAST), or static analysis, is a testing methodology that analyzes source code to find security vulnerabilities that make your organization's applications susceptible to attack. SAST scans an application before the code is compiled. It's also known as white box testing. https://www.synopsys.com/glossary/what-is-sast.html

• Static Code Analysis - The act of reverse-engineering the malicious program to understand the code that implements the software behavior. For example, when looking at compiled programs, the process involves using a disassembler, a debugger, and perhaps a decompiler to examine the program’s low-level assembly or byte-code instructions. A disassembler converts the instructions from their binary form into the human-readable assembly form. A decompiler attempts to recreate the original source code of the program. A debugger allows the analyst to step through the code, interacting with it, and observing the effects of its instructions to understand its purpose. https://csrc.nist.gov/glossary/term/code_analysis

• System Development - The scope of activities associated with a system, encompassing the system’s initiation, development and acquisition, implementation, operation and maintenance, and ultimately its disposal. https://csrc.nist.gov/glossary/term/system_development_life_cycle

• Timestamp - A token or packet of information that is used to provide assurance of timeliness; the timestamp contains timestamped data, including a time, and a signature generated by a Trusted Timestamp Authority (TTA). https://csrc.nist.gov/glossary/term/timestamp

• Web Application Firewall - A firewall that uses stateful protocol analysis to analyze network traffic for one or more applications. https://csrc.nist.gov/glossary/term/application_firewall

Key Concepts & Elements

This rubric is designed to gather information about a supplier’s base level security policies, procedures, and systems to identify their security posture. Each institution and school district has a responsibility to ensure that the supplier solutions meet institutional security requirements. This rubric is designed to provide a concise and consistent tool to provide insight for institutions to decide how they would like to proceed with their procurement process.

What is a Rubric and how is it being used here?

A Rubric is a scoring guide used to evaluate performance, a product, or a project. Typically, it has three parts: 1) performance criteria, 2) rating scale, and 3) indicators.

Figure 1 Source:https://facultyinnovate.utexas.edu/sites/default/files/build-rubric.pdf

This TrustEd Apps Security specification defines a Rubric that institutions and school districts can use for enhanced App Vetting. Members of the 1EdTech community pooled their collective evaluation criteria into a common rubric for reviewing 3rd party apps (members also looked at criteria set by other organizations that vet applications for their security practices). These collective criteria cover a basic set of questions that suppliers need to provide answers and evidence to when self assessing their applications.

With a common set of evaluation criteria, each institution or school district can specify their requirements in a consistent way making it easier for suppliers to self-assess their apps. In addition, when responding to requirements coming from each of their educational customers, suppliers will also have a consistent way to document their own apps’ behavior in each of the required areas.

TrustEd Apps Security Practices Rubric

While the rubric is a starting point for reviewing the security practices of a digital resource or application, this enables open communication between 1EdTech suppliers and districts/institutions to work together to provide an accurate self review of the suppliers products. The open collaboration between districts/institutions and suppliers also promotes transparency that helps members understand the various components of security policies, practices, and procedures and why they are necessary.

The App Vetting Process

The Rubric

The following tables show each question with specific language which should be used as the evaluation criteria for vetting apps.

References

• HECVAT. Retrieved from (https://library.educause.edu/resources/2016/10/higher-education-community-vendor-assessment-toolkit)

• Educause Higher Education Community Vendor Assessment Toolkit https://library.educause.edu/resources/2016/10/higher-education-community-vendor-assessment-toolkit