安全性测试

Blackboard 在代码级别（静态分析）和应用程序级别（动态分析）执行持续内部安全性测试，以确保其符合 Blackboard 和客户的期望。此外，为了定期了解应用程序的最新情况，Blackboard 会从第三方安全供应商处获得安全性渗透测试。发现的任何问题都会得到快速修复。

静态应用程序安全测试

Blackboard 利用开放源代码和商业静态分析扫描程序来持续评估 Blackboard Learn 源代码。通过这些工具，Blackboard 可以在系统与构建环境集成而不断演进升级的过程中，发现源代码中的潜在漏洞。通过手动代码复查，Blackboard 会结合进行自动源代码分析，以查找安全漏洞。

动态应用程序安全测试

Blackboard 利用开放源代码和商业动态分析扫描程序来持续评估 Blackboard Learn 应用程序。自动安全扫描程序可从最终用户的视角来测试常见的 Web 应用程序漏洞。

手动渗透测试

静态和动态应用程序安全工具无法检测所有安全问题。为了进一步降低安全风险，Blackboard 会执行手动渗透测试，以识别更复杂的安全漏洞和业务逻辑问题（如不正确的授权）。

Security patches and advisories

Blackboard publishes security patches and advisories through Behind the Blackboard.

BbPatch

Customers may install the latest patches using "BbPatch," a package management utility to manage updates to Blackboard products, such as cumulative patches. BbPatch complements the Blackboard Installer by allowing small, reversible updates with minimal downtime.

Software updates

The Software Updates module is located in the Blackboard Learn Administrator Panel and provides updates specific to your Blackboard Learn installation, including Major Releases, Service Packs, and Patch Sets, as well as building block updates and newly released building blocks. The module lists the number of updates that are available. You can select which updates to download.

Security advisories

Blackboard is committed to the timely identification, communication and resolution of security vulnerabilities identified in our products. Security Advisories are released with the following information:

  • Advisory ID - for Knowledge Base tracking purposes
  • Title - Brief description of affected area
  • Issue Date
  • Severity

This is followed by a vulnerability overview, which details the nature of the security vulnerability; a functional issue overview which describes how the system may be affected; a list of product version(s) affected; description of discovery; and a description of the solution with a link to applicable patches. Blackboard also tracks and advises our clients of any known exploitation or malicious use of security vulnerabilities. The mitigations and workarounds section describes any mitigations clients may take or if a workaround is available. If there are multiple revisions to an advisory, a short summary of the update is provided.

Security vulnerability scoring

Blackboard follows the industry standard of CVSSv2 (Common Vulnerability Scoring System Version 2.0) as a guideline. Customers may use our severity ratings as a guideline to help classify the impact of security issues found in Blackboard Learn. It is based on average usage, since not all vulnerabilities have equal impact on all users - for example, customers might not have the affected module enabled, or its use of the module may not contain as critical information as another customer.

Input Validation Filter - Security management building block

The Input Validation Filter acts as a first line of defense with configurable rules to protect Blackboard Learn. It is, in a sense, like a firewall for Blackboard Learn. It verifies that user requests coming in are safe by sanitizing the data through a default ruleset. An advantage of the Input Validation Filter is speed. This feature provides you with cross-site scripting fixes much faster than the traditional patching process. Traditional patches can have various dependency issues or may need to be rolled back. Providing fixes through the Input Validation Filter is a much cleaner and faster way of delivering patches, as they are provided directly through the Software Updates Center.