Blackboard DevCon 2011 – Blackboard Learn Security Reference Architecture

• Slide deck has an interesting slide on threat categories and corresponding controls
• Recommend SSL system-wide  with 2048-bit key.
• Secure performance – SSL on the load balancer rather than the server (off-loading to be supported soon)
• Adopt a single sign-on provider (SSO) to enforce strong passwords, password resets, throttling/locking
• Session hijacking risk in Content Management – disable usage of persistent cookies (users will have to authenticate multiple times)
• bb-tasks.xml can be used to tweak session invalidation
• Look at Session Fingerprinting to prevent session hijacking.
• Consider whether Guest access is needed.  Four places to toggle:  Gateway Options, Course Tools, Default Course Settings, Default Organization Settings
• Enable Globsl Cross-site Scripting Filter (on by default at strictest setting).  Also enable for file uploads (bbconfig.fileupload.enable.xss=true)  Article in WikiKB with more info.
• Evaluate which system and course/organization roles require ability to enter dynamic content.
• Enable Grade History.  Do not allow instructor to clear the history.
• Monitor for changes to system configuration – properties files in config folder  and system registry in database table
• Monitor privileged accounts for access from unexpected IPs / user agents in BBLEARN.sessions table
• If CVSSv2 score is > 7, Blackboard will usually release a patch (unless it’s something widespread and better handled by a service pack)
• Contact LearnSecurityCommunity@blackboard.com if you’d like to participate in a security community
• Real-time anti-virus scanning is on the roadmap.