In the ever-evolving world of eLearning, privacy and security takes centre stage. It’s crucial for organisations and educational institutions to protect learner data and establish a secure online learning space. As one of the leading global Learning Management Systems (LMS), Moodle is dedicated to security and privacy.
In this blog, we will share more about why Moodle is a trusted LMS worldwide, concentrating on its approach to security and features such as multi-factor authentication and utilising read-once web service tokens, among others.
Our commitment to security and privacy
At Moodle, we are dedicated to developing solutions that prioritise our user’s data privacy and our software’s security. Each of our new developments aims to comply with legal regulations by assessing how user data is gathered, preserved, accessed and removed.
Privacy by design
Every advancement in Moodle LMS is designed with a strong focus on data privacy, specifically the capture, storage, access, and deletion of user data. An example of this commitment is the integration of the “do not track” option from YouTube or Vimeo platforms, significantly reducing tracking data available to those platforms when used in learning content. This feature boosts user control over online privacy, ensuring that no data is accessed without explicit consent. It allows educators and students to utilise video content in online learning while preserving their privacy, reinforcing our commitment to ongoing privacy enhancements.
To aid organisations in extending their privacy compliance to plugins external to Moodle LMS, we’ve developed a Privacy API. This is a requisite for plugin developers to implement, ensuring their add-ons are GDPR compliant. Moodle LMS’s privacy features enable GDPR compliance and adherence to local privacy laws, ensuring transparency in data handling while protecting minors with online access through age-consent checks and parental permissions.
Security by design
Our development process is rooted in “security by design,” focusing on security from the outset of our platform development. As an open-source platform, security is enhanced by our community of developers, facilitating constant scrutiny and enhancement of the source code, unlike proprietary software, where there is no source code visibility or transparency. Rapid identification and resolution of issues help us minimise vulnerability risks and prevent potential security breaches.
To safeguard our entire user base, we adhere to a policy of responsible disclosure. This policy dictates that we only publicly disclose problems after solutions have been made available and once registered Moodle sites have had the opportunity to update or apply patches. Additionally, for individuals managing their own Moodle sites, we provide advice and recommended practices to improve the security of their installations.
Moodle LMS latest release: More secure than ever
At Moodle, we emphasise security throughout platform development, integrating advanced features that directly contribute to a safer learning environment for all users. Our latest release incorporates new enhancements that highlight Moodle’s commitment to security and privacy, ensuring that every aspect of our platform not only secures user data but also fosters a trust-rich environment conducive to learning.
Multi-factor Authentication (MFA)
Moodle has enhanced its online learning security by integrating the Multi-Factor Authentication (MFA) feature, also known as Two-factor Authentication (2FA). This protocol requires users to provide two or more identification forms for account access, such as a password and a one-time app-generated code. This strengthens defences against unauthorised access and is significant for educational institutions handling sensitive data, ensuring access only to authorised individuals and enhancing privacy protection.
Seamless integration with hardware-based security keys
Moodle’s MFA capabilities include a smooth integration with physical authentication keys, such as Swissbit, for comprehensive user identity confirmation. Swissbit, provides secure and durable storage and embedded solutions, ensuring data integrity and reliability in demanding environments, bolstering the effectiveness of Moodle’s two-step identity verification.
Our latest release saw notable enhancements in multi-factor authentication (MFA), enabling the use of physical authentication tools to add a significant layer of protection against unauthorised access to users’ accounts, requiring physical access to their specific hardware key in addition to standard login credentials.
Other features
In addition to the enhancements above, Moodle’s recent security features underscore our unwavering commitment to safeguarding user data. With the implementation of “password peppers,” we’ve introduced an additional layer of security to user passwords, significantly bolstering their security by incorporating an extra secret key into the hashing process, which is not stored in the site’s database. Our new “read once web service tokens” feature is designed to enhance security for external services, by reducing the chance of unauthorised token usage and encouraging the generation of new tokens for each service. We’ve also provided administrators with the flexibility to customise security settings, allowing for a tailored approach to address specific threats and vulnerabilities. Additionally, the “security overview report,” exclusive to administrators, offers a comprehensive evaluation of the site’s security posture, enabling a proactive stance in maintaining and enhancing security measures.
