A Finite Set of Test Security Threats

By Dave Foster, Chairman and CEO, Caveon

In the area of test security, I have some good news and some bad news. The good news first: There is a very limited number of test security threats to worry about. Over the past few years I’ve tried to categorize them as efficiently as possible and have come up with a total of only twelve. That’s not too many to get our minds around and to develop some effective counter-measures. These twelve threats are further subdivided into cheating threats and stealing threats, six each. Cheating threats are those designed to inappropriately increase a score on a test. Stealing threats focus on the theft of test content, and will eventually lead to cheating. The table shows the twelve threats:

Cheating Threats

Stealing Threats

Using pre-knowledge of test content

Hacking into a system and stealing test files

Colluding with others

Capturing content by digital photography devices

Using cheating aids

Capturing content by electronic recording of the screen

Using a proxy test taker

Memorizing content

Modifying the scoring process after the test is completed (e.g., hacking into a score database or changing answers on answer sheets)

Transcribing content verbally (on paper or recording device)

Copying answers from other test takers

Getting content from test program insider


Because each program’s circumstances are different, I haven’t ranked them in the table in terms of the amount of damage each threat can cause if a breach occurs. It is better that each testing program do so based on the importance of the tests, audience characteristics, risk aversion, and so on.  Ranking them is a good activity as it will lead to a better allocation of resources.

Now the bad news: Each of these threats may be comprised of a few or a large number of different methods. As an example, there may be hundreds of different types of cheating aids, such as cell phones, calculators, hidden cheat sheets, answers written on shoes, answers on labels of water bottles, and many, many more. As another example, collusion can happen between two test takers in the same room, between a proctor and a test taker, or by another person communicating with the test taker at a distance through hidden 2-way radios. In considering a threat, programs need to be aware of the many ways that threats may be manifested.

But, there is more good news. Often the same or similar counter-measure for one of these specific methods will work for many of the others. For example, better authentication methods will work for professional proxy testing services as well as for the situation where a test taker asks a friend to take the test for him or her. Another advantage of considering the more general threat level is that test security policies and rules are probably best set at the threat level rather than targeting the specific method. That is, it is better to ban all cheating aids (and give some examples) than just a cell phone.

So, while the number and variety of test security problems seem to be overwhelming and at times it probably appears that we are losing the battle, take heart that there are better ways to understand what we are up against and better ways to organize our defense and counter-measures.




Leave a Reply