An attack-defence tree of e-exam system

Abstract

Not only does the electronic-examination (e-exam) system transform the paper-based into the electronic-based examination, but it also brings about security challenges that must be resolved to guarantee the trust of its users. This paper aims at analysing security challenges of an e-exam system and proposing a solution using Attack and Defence Tree method. The attack tree scheme was defined by risk assessment methods and then evaluated by penetration test experiments against a server running the e-exam application. A proposed defence tree scheme against the identified attack tree was presented as the main contribution of this research. This contribution can be used as a guideline to plan similar e-exam systems and can be served as a starting point for future research towards a comprehensive attack-defence tree of the secure e-exam system.