Testen van beveiliging
Blackboard voert doorlopend interne beveiligingstests uit op codeniveau (statische analyse) en toepassingsniveau (dynamische analyse) om er zeker van te zijn dat alles voldoet aan de verwachtingen van zowel Blackboard als onze klanten. Om tunnelvisie te voorkomen, laten we regelmatig penetratietests uitvoeren door externe bedrijven die hierin zijn gespecialiseerd. Eventuele verbeterpunten worden direct geregistreerd voor aanpassing.
Statische toepassing van testen van beveiliging
Blackboard maakt gebruik van open source en commerciële statische scanners van analyses om Blackboard Learn-broncode continu te beoordelen. Met deze tools kan Blackboard mogelijke problemen in de broncode identificeren als het systeem zich ontwikkelt door integratie met Build-omgevingen. Blackboard koppelt geautomatiseerde analyse van broncode voor beveiligingsproblemen met handmatige herzieningen van code.
Dynamische toepassing van testen van beveiliging
Blackboard maakt gebruik van open source en commerciële dynamische scanners van analyses om de Blackboard Learn-applicatie continu te beoordelen. De test voor geautomatiseerde beveiligingsscanners voor veelvoorkomende problemen van webtoepassingen vanuit het perspectief van een eindgebruiker.
Handmatige penetratietests
De functies voor statische en dynamische toepassingsbeveiliging kunnen geen beveiligingsproblemen detecteren. Om het beveiligingsrisico verder te beperken, voert Blackboard handmatige penetratietests uit om meer complexe beveiligingsproblemen en problemen met bedrijfslogica zoals onjuiste autorisatie te identificeren.
Security patches and advisories
Blackboard publishes security patches and advisories through Behind the Blackboard.
BbPatch
Customers may install the latest patches using "BbPatch," a package management utility to manage updates to Blackboard products, such as cumulative patches. BbPatch complements the Blackboard Installer by allowing small, reversible updates with minimal downtime.
Software updates
The Software Updates module is located in the Blackboard Learn Administrator Panel and provides updates specific to your Blackboard Learn installation, including Major Releases, Service Packs, and Patch Sets, as well as building block updates and newly released building blocks. The module lists the number of updates that are available. You can select which updates to download.
Security advisories
Blackboard is committed to the timely identification, communication and resolution of security vulnerabilities identified in our products. Security Advisories are released with the following information:
- Advisory ID - for Knowledge Base tracking purposes
- Title - Brief description of affected area
- Issue Date
- Severity
This is followed by a vulnerability overview, which details the nature of the security vulnerability; a functional issue overview which describes how the system may be affected; a list of product version(s) affected; description of discovery; and a description of the solution with a link to applicable patches. Blackboard also tracks and advises our clients of any known exploitation or malicious use of security vulnerabilities. The mitigations and workarounds section describes any mitigations clients may take or if a workaround is available. If there are multiple revisions to an advisory, a short summary of the update is provided.
Security vulnerability scoring
Blackboard follows the industry standard of CVSSv2 (Common Vulnerability Scoring System Version 2.0) as a guideline. Customers may use our severity ratings as a guideline to help classify the impact of security issues found in Blackboard Learn. It is based on average usage, since not all vulnerabilities have equal impact on all users - for example, customers might not have the affected module enabled, or its use of the module may not contain as critical information as another customer.
Input Validation Filter - Security management building block
The Input Validation Filter acts as a first line of defense with configurable rules to protect Blackboard Learn. It is, in a sense, like a firewall for Blackboard Learn. It verifies that user requests coming in are safe by sanitizing the data through a default ruleset. An advantage of the Input Validation Filter is speed. This feature provides you with cross-site scripting fixes much faster than the traditional patching process. Traditional patches can have various dependency issues or may need to be rolled back. Providing fixes through the Input Validation Filter is a much cleaner and faster way of delivering patches, as they are provided directly through the Software Updates Center.