Is SCORM Secure?

I get asked often whether the Runtime API is secure.

The straight answer is no.

But, there are things that can be done on the platform side to mitigate some of the common issues we face.

1. Bookmarklets or cheatlets These allow a student to inject code on your platform that connects to the Runtime API and in an automated fashion reports a good score and status. This gives the illusion that the student fulfilled the content. Common issue with this is if your content is more complex you may actually have reported objectives and or interactions, and possibly even have a false session time, or very short session time reported. Either way, there are data forensics here to review if a student truly took the content. The portal can block domain access for other scripts that get injected via XSS Cross-site Scripting. Just be aware there are older browser that ignore these protocols.
2. Direct Console Interaction Modern browsers come with Inspectors which can be turned on for Developers. Unless you completely control you students access to the Learning Management Server, this allows students to attempt to directly issue SCORM commands against the Runtime API. Code can also be dropped in to detect these commands to halt direct communication with the Runtime API.

It's also important to understand there is more than one way to skin a cat. As parents and authorities install key-loggers, and other tools to effectively spy, restrict or obtain a report of the computer use, this can get flipped around on a teacher. Suddenly the password to the teacher keys, portal, spreadsheets etc. are now exposed and a student has the capability to adjust their grades.

Controlled Access

For some customers, the idea of creating a Shareable Content Object without any Digital Rights Management is a frightful concept. This intellectual property is commonly sold with a platform, or bundled and deployed to 3rd party platforms. You would have to go to other means to secure your content with access keys, which commonly means fulfilled cross-domain scripting, or referencing all your assets on a repository and locking it down that way.

Security through Obscurity

Lastly, its always a good idea to not directly call out correct answers in human readable formats. I've seen people place code directly in HTML which can be inspected for the correct answer. This is also true of XML, JS/JSON and CSV files. It does take extra steps to encode/decode and make your data models harder to read in a production environment, but it commonly is time well spent.

Do you show correct answer in feedback?

Common trick to obtain the correct answers is to unplug the ethernet cable or disconnect the WiFi in order to run through all your questions and write down the correct answers. Then, get back online and take the test for real.

Do you leave answers to questions exposed in HTML, or another format?

Just utilizing the console available in most modern browsers gives a student instant access to source code, network traffic and all resources used by your content. This isn't just a SCORM problem, it is the nature of semantic languages of the web. Popular issues that read like a book:

<answers>
     <answer id="1" correct="false">Bob</answer>
     <answer id="2" correct="true">Frank</answer>
     <answer id="3" correct="false">Mike</answer>
     <answer id="4" correct="false">Seth</answer>
</answers>