Lessons Learned in Securing Blackboard

This paper details the efforts taken to secure Blackboard, a Course Management System (CMS), at an educational institution. Blackboard is currently in use at over 6000 institutions, and CMS use has risen dramatically in recent years. The institution's initial Blackboard implementation was accomplished without any system security policies or safeguards in place. The paper describes the initial process, and then details the variety of system compromises (including a UNICODE compromise and one compromise of unknown origin) and security safeguards that were put in place in the following months. The process of increasing the security of Blackboard proved invaluable for the institution, leading to a number of positive outcomes for Blackboard and for systems across the institution. The paper includes a summary of steps taken to further security, ongoing security concerns and the plans to address them, and some questions for future research.