System Administrators should consider secure application configuration practices in order to further harden your Blackboard Learn solution.
Identification and Authentication
Harden System Accounts
- Ensure the default "administrator" account password is complex and rotated regularly per your organization's Access Management policies.
- Change the default "root_admin" account password. Ensure it is complex and rotated regularly per your organization's Access Management policies. See Managing User Accounts.
- Change the default "Integration" account password. Ensure it is complex and rotated regularly per your organization's Access Management policies. See Edit the Integration Password.
- Review default privileges assigned to each System Role and Course Role.
Guest Access Review
- Review if Anonymous (Guest) Access is appropriate at all four levels:
- System Admin > Security > Gateway Options
- System Admin > Course Settings > Course Tools
- System Admin > Course Settings > Default Course Settings
- System Admin > Organization Settings > Default Organization Settings
Secure User Password Migrations
- Verify successful password migrations. Monitor user accounts that have not migrated and reset passwords. This is applicable beginning in Blackboard Learn, Release 9.1 Service Pack 12 when Secure User Password Storage was released.
- Verify application administrator passwords migrated. See the "Blackboard Configuration File" section of Secure User Password Storage
Use Third Party Authentication Systems
- Fully use third party authentication systems such as LDAP and Active Directory. See LDAP Authentication with SSL. This provides the ability to enforce password complexity policies, obtain login failure throttling, etc.
- As a practice, do not use shared accounts. Power users should use their own accounts to help ensure accountability for changes to the system.
- Monitor usage of default system accounts by reviewing the security logs. See Audit and Accountability.
Disable Persistent Cookies
- Go to System Admin > Content Management > Technical Settings > Authentication Settings
Audit and Accountability
Ensure Security Logging is Enabled for Load-balanced Configurations
- Ensure Client IP Address appears in all logs. Verify this immediately. Otherwise, security logs will all indicate the load balancer IP address, limiting security forensics capabilities. Review information on X-Forwarded-For in Load Balancer Guidelines.
- Enable Grade History.
- Do not allow Instructors/Assistants to change auditing status.
- Do not allow Instructors/Assistants to clear grade history.
Review Log Aggregation Practices
- Consider log archiving duration. How far back do you need to go?
- Use a third party log aggregation tool.
System and Communications Protection
Use SSL System-wide
- Enable SSL system-wide.
If you are receiving mixed content warnings, tell users to upload the files into Learn
- Ensure high strength ciphers (SSLv3, TLSv1).
SSLProtocol -ALL +SSLv3 +TLSv1
- Use minimum 2048-bit key SSL Certificates.
- For Apache Web Server configurations, set quieter headers. Set OnServerSignature Off.
Reduce Session Timeout
- Ensure that the session timeout setting is set to a reasonable level as it mitigates session hijacking.
Default is three hours with an hourly task to cleanup the sessions (up to four hours).
To modify, change the properties of the “bb.session.invalidation” task of the BLACKBOARD_HOME/config/bb-tasks.xml.
- Modify the "bb.session.invalidation" task in BB_HOME/config/bb-tasks.xml
- Delay – Period before the server starts before the first task is run (milliseconds)
- Period – Frequency of invalidation task (milliseconds)
- Invalid – User session timeout period (milliseconds)
System and Information Integrity
Configure Alternate Domain for Serving Content
- Not a default setting because it requires certificates
- See Alternate Domain for Serving Content.
Tailor Safe HTML Policy to your needs
Review usage of "Add/edit trusted content with scripts" privilege
- This is similar to privileges review. By default, Administrators and Instructors receive the privilege to use unrestricted HTML. If only a limited set of users need the ability to perform dynamic scripting, consider creating a custom role, placing users into that role, and granting just that role this particular privilege. This follows the security principle of Least Privilege.