Leiter Reports: A Philosophy Blog

News and views about philosophy, the academic profession, academic freedom, intellectual culture, and other topics. The world’s most popular philosophy blog, since 2003.

  1. OLP's avatar
  2. Roger Albin's avatar
  3. James Bondarchuk's avatar
  4. Gregory Slack's avatar
  5. John Rapko's avatar

    The image next to Wittgenstein is actually John Turturro saying ‘If pasta could talk, I’d understand it’.–On a lighter note:…

  6. F.E. Guerra-Pujol's avatar
  7. Adam Shear's avatar

    And the image of eyeglasses in the linguistic turn panel are not eyeglasses. (oh wait, I thought we were playing…

How is your school responding to the “Canvas” security breach by hackers?

Most academic readers will have heard of this fiasco. How is it affecting grades, finals, etc.? Is your administration expecting instructors to carry on as though nothing happened? You can post anonymously, but please include a valid university email address (which will not appear).

,

Leave a Reply

Your email address will not be published. Required fields are marked *

3 responses to “How is your school responding to the “Canvas” security breach by hackers?”

  1. When I was in college, the University IT department would host and support email, LMS, CMS, database, and other technology related services, right on campus. Sometime in the mid 2000s, these services began to be off-loaded to for-profit companies like Google and Microsoft. Why? To save money? For improved security?

  2. The Canvas outage (as opposed to the earlier data breach) occurred on the penultimate day of classes at UMass Amherst. The next morning, access was restored to most services. Hence, the impact was fairly minimal. Our administration sent out recommendations for contingency planning, including exporting a local copy of the Canvas gradebook after every assignment is graded and developing alternate ways to share course materials and receive students’ final papers. They do not expect instructors to ignore the problem, and they are providing guidance, but it still creates more work for individual instructors.

    In reply to Robert’s question at 8:45am, in 2020 my university shifted from its in-house email system to Microsoft (for most faculty and staff) and Google (for students, visitors, and a handful of faculty and staff who chose/choose it) primarily due to security concerns. The volume of attempted security breaches was increasing dramatically, and we simply didn’t have the IT resources to keep up. There had also been demand, especially among administrators, for more up-to-date integration of email with calendaring and file storage, but my impression from talking to IT leadership is that security was the main concern.

    I’m not an IT security expert, just someone who tries to keep up with the basics, but I’m pretty sure our decision to move our LMS (at the time, Moodle) from a locally hosted installation to a cloud service was driven by the same concerns. Local hosting requires a lot of time not just to fend off attack attempts but also to track and install updates in a timely manner without breaking functionality that users need.

    One unintended consequence, though, is that by concentrating thousands of institutions’ LMS services on one platform, Instructure (Canvas) ended up providing a potentially very lucrative target to attackers, while still being a medium-sized company without the resources of Microsoft, Google, etc. to defend against attacks. (Instructure was acquired in 2024 by KKR, a private investment fund, for just under $5 billion, making it three orders of magnitude smaller than Microsoft, Alphabet (Google), and Apple.)

  3. F.E. Guerra-Pujol

    Although the hack occurred with less than 24 hours before our grades were due, our provost sent a pointless email saying how the university was “closely monitoring” the situation instead of just extending the deadline.

Designed with WordPress