Security and Usability of Client Virtual Machines in School Environment: Threat Analysis and AHP-Based Ranking of Security Measures

АУТОР(И) / AUTHOR(S): Snežana Mijailović  and Marjan Milošević 

Download Full Pdf   

DOI: https://doi.org/10.46793/TIE26.291M

САЖЕТАК /ABSTRACT:

This paper examines the transformation of school networks through the transition from traditional desktop configurations to a centralized Virtual Machine (VM) infrastructure. The research focuses on identifying an optimal balance between system security and usability in an educational context. The methodology includes a qualitative case study conducted at the Gymnasium “Takovski ustanak” in Gornji Milanovac, incorporating thematic analysis of students’ surveys, administrator interviews, and technical threat analyses based on recent (2024) reports from Sophos, ENISA, and MITRE. The results indicate that while the VM system significantly enhances stability and simplifies centralized administration, it also introduces certain limitations in terms of user flexibility and software installation. A key component of the study is application of the Analytic Hierarchy Process (AHP) model for ranking security measures. The AHP results suggest that maintaining the existing configuration, supplemented with enhanced monitoring and sandboxing, provides the best balance between protection and practical usability. Furthermore, technical issues such as invalid SSL/TLS certificates were identified as potential risks for Man-in-the-Middle attacks, leading to recommendations for implementing an internal PKI infrastructure and improving user education. This research provides actionable guidelines for improving digital educational environments in Serbia.

КЉУЧНЕ РЕЧИ / KEYWORDS: 

virtual machines (VM), network security, usability, AHP model, school environment, cyber threats

ПРОЈЕКАТ / ACKNOWLEDGEMENT:

ЛИТЕРАТУРА / REFERENCES:

• Ministry of Information and Telecommunications. (n.d.). Connected Schools. Retrieved from: https://mit.gov.rs/tekst/192/povezane-skole.php
• Alruwaili, F. F., & Gulliver, T. A. (2018). Secure migration to compliant cloud services: A case study. Journal of Information Security and Applications, 38, 50–64. https://doi.org/10.1016/j.jisa.2017.11.004
• Petrova, V. (2021). A decision hierarchical model of cybersecurity risk assessment. UBM Spring Conference.
• Saaty, T., & Vargas, L. (2012). Models, methods, concepts, and application of the analytic hierarchy process. Springer.
• Aleksić, V., & Ivanović, M. (2016). Psychometric evaluation of the reliability of IPVIS-OS. Journal of Educational Sciences and Psychology, 6(1), 21–34.
• Yin, R. K. (2018). Case Study Research and Applications: Design and Methods (6th ed.). Sage.
• Harvie, D. P., et al. (2019). Using Virtual Machines to Enhance the Educational Experience. Proceedings of SIGITE, 28–32.
• Karlov, A. A. (2016). Virtualization in education: Information security lab in your hands. Physics of Particles and Nuclei Letters, 13, 640–643.
• Ristenpart, T., et al. (2009). Hey, you, get off of my cloud. Proceedings of ACM CCS, 199–212.
• (n.d.). MITRE ATT&CK Framework. Retrieved from https://attack.mitre.org/
• (2024). ENISA Threat Landscape 2024. https://securitydelta.nl/media/com_hsd/report/690/document/ENISA-Threat-Landscape-2024.pdf
• (2024). 2024 Sophos Threat Report. https://news.sophos.com/en-us/2024/03/12/2024-sophos-threat-report/
• Ranđelović, B., et al. (2022). Distance learning in Serbia: Experience in primary education during COVID-19 crisis. TEME, 46(2), 377–397.
• Hyde, D. (2009). Security in Virtual Machine Environments [Master’s thesis / Technical report]. Washington University in St. Louis.
• Kumaraguru, P., et al. (2007). Protecting people from phishing. Proceedings of CHI ’07, 905–914.
• Adams, C., & Lloyd, S. (2003). Understanding PKI: Concepts, Standards, and Deployment Considerations. Addison-Wesley.
• Housley, R., et al. (2002). Internet X.509 Public Key Infrastructure Certificate and CRL Profile (RFC 3280). IETF.