Cybersecurity has never been more important, “Between January 1, 2005, and May 31, 2020, there have been 11,762 recorded breaches.” Whether you’re training different customers and organizations or selling commercial training, customers want to know their data and personal information is being protected. For example, customers enrolled in training programs don’t want their data shared with outside companies. Going with the wrong LMS provider could cost people their jobs if the correct security measures aren’t in place when a breach or cybersecurity attack occurs.

So, how can you make sure your LMS is secure?

There’s much more that goes into keeping your LMS secure than requiring users to create a “safe” password. In this article, we’re going to talk about the 9 essential security features of an LMS.

SSL

Secure Sockets Layer (SSL) is a piece of code on a website that secures online communications and keeps information private. When you connect to a website using a web browser (like Google Chrome) if SSL is enabled then an encrypted link is created. SSL is what keeps an internet connection secure and protects any sensitive data like credit card information from being sent between two systems or read and modified by outside persons.

Your LMS and any LMS portals created for your customers should have SSL enabled, so everyone’s private information is kept safe.

How can we tell if SSL is enabled? When you see a padlock next to a website’s URL.

Even though you may not be selling courses using eCommerce, SSL is still an important factor in keeping your LMS and the information within it safe. Remember, if you’re training other organizations using portals in your LMS, then each sub-domain must have SSL enabled as well, not just your main website!

2-Step Verification

2 step verification is a setting that requires users to enter a code sent to their phone in addition to entering in their regular username and password while logging into the LMS. This added security measure may be inconvenient for users at times (when their phones are not next to them), but while enabled it’s very difficult for unwanted users to log in to your platform. In fact, unless a hacker has access to both your phone and your login credentials, there’s really no way they can log in to your LMS while 2-step verification is turned on.

Complex Password Requirements

No brainer, right? Wrong. “ An estimated 81% of data breaches are due to poor password security.” Requiring complex passwords for registering users is the very first level of security your LMS should have. Our registration page requires passwords to be “Between 6 and 22 characters long with at least one lowercase, uppercase, number, and symbol.” A password that follows this structure is automatically more secure than a simple password like, “12oranges”.

Reliable & Frequent Data Backups

Making it difficult for unauthorized users to get into your platform by enabling 2-step verification and requiring complex passwords is great, but these front-end security measures don’t protect against data loss. Most drivers get car insurance to protect their vehicle in case they get in an accident – meanwhile, cloud-based LMS providers protect their customers’ data by performing regular backups.

• Backups should always be done offsite on a separate server.
• Backups should be tested frequently to ensure data is being stored correctly.
• We recommend backups be performed daily (that’s what we do).

Continuing, the time it takes to restore from a backup should be as short as possible, and in the case of a backup failure – site admins should be notified immediately.

Single Sign-On (SSO)

SSO is a way for a user to have one set of credentials for all of their applications. For example, using SSO, users can log in to the LMS using their work email address and password instead of having to remember a new set of log-in credentials. Single Sign-On is commonly used by employers who wish to control the credentials of their employees. This is convenient and secure for organizations whose employees all use one domain-specific email address.

In addition to Single Sign-On, check out what other integrations our platform offers!

Locked Content

Whether you’re selling training B2C or providing customers and partners with training programs for their teams, you want to prevent users from downloading and stealing your content. Your LMS should be able to prevent users from downloading videos, SCORM modules, and any other content assets in the platform unless otherwise specified. The last thing you want is for customers enrolled in exclusive training to steal your course and resell it to others or give it away for free.

User Roles

Your users enrolled in training courses should have less access inside of the platform than administrators and instructors who are managing the platform. For example, if a user completes a test they shouldn’t be able to adjust their final grade, and if they respond to a discussion board they shouldn’t be able to grade themselves; certain actions and responsibilities in an LMS should be reserved for select users.

User Roles define who’s able to do what in an LMS and limit certain administrative permissions like being able to add or delete students and grade assignments to specific users.

System Audit Logs

The Audit Log holds a record of all actions and events that take place in your system and make note of who is completing each action. Each log in your system should be timestamped, and your audit log should record all data being created, modified, or deleted in your platform (course creation, quiz submissions, new users enrolling, etc.). Audit logs also record automated system actions, so if 10 people submitted a test and all of their grades were returned immediately.

With the help of audit logs, your company can monitor for data misuse and greatly reduce security vulnerabilities and the potential for system breaches.

GDPR Compliance (if you’re an EU business)

If your company is based out of Europe then you will want to ensure your LMS provider is compliant with the General Data Protection Regulation (GDPR). “At its core, GDPR is a new set of rules designed to give EU citizens more control over their personal data. It aims to simplify the regulatory environment for business so both citizens and businesses in the European Union can fully benefit from the digital economy.” Academy Of Mine follows this protocol and we talk about it in our privacy policy. Ensuring your LMS provider follows the GDPR means they are following a select set of rules when it comes to how much data they can retain and what they can do with that data.

What LMS do we recommend?

If you’re already partnered with an LMS provider that is doing amazing by you, by all means, keep working with them. If you’re not 100% satisfied with your current provider, let’s change that! Academy Of Mine LMS has all of these security features and more – and we would love to explain your options and give you a personalized solution today!