e-Literate

Present is Prologue

Category: LMS & Learning Platforms

Everything you want to know about Learning Management Systems and whatever comes after them.

  • Instructure Security Assessment Results

    Instructure has engaged Securus Global to test the Canvas LMS product for security vulnerabilities.  Instructure has also invited me to be an independent observer – participating in the process and independently reporting on the testing and Instructure’s response to any vulnerabilities identified.  Part 1 of this series of posts described the concept.  Part 2 gave a mid-term update, describing the process involved and initial results.  In this post I’ll describe the full results of the security assessment.  I’ll add my actual analysis in the final post.

    The purpose of the testing was to validate and review the Canvas LMS design and implementation with respect to vulnerabilities that could be exploited by a motivated hacker.  Securus employed security experts to ethically hack, both manually and with automated tools, a test environment to try and identify specific vulnerabilities, working from the perspective of both an unauthorized user and an authorized user.  There was a range of exploits tested, but the basic idea is to find out if someone could access information or functionality that should be protected by system controls including role-based security.

    Summary of Findings

    The findings were presented to Instructure on November 29, 2011 in report form and with a conference call to discuss.

    (more…)

  • Instructure Security Mid-Term

    Instructure has engaged Securus Global to test the Canvas LMS product for security vulnerabilities.  Instructure has also invited me to be an independent observer – participating in the process and independently reporting on the testing and Instructure’s response to any vulnerabilities identified.  Part 1 of this series of posts describes the concept.  In this post, I’ll give a mid-term update, describing the process involved and initial results.  In the next post I’ll describe the full results of the security testing.  I’ll try to keep my actual analysis in the final post, after I have objectively described the process and results.

    The purpose of the testing was to validate and review the Canvas LMS design and implementation with respect to vulnerabilities that could be exploited by a motivated hacker.  Securus employed security experts to ethically hack a test environment to try and identify specific vulnerabilities, working from the perspective of both an unauthorized user and an authorized user.  There was a range of exploits tested, but the basic idea is to find out if someone could access information or functionality that should be protected by system functionality including role-based security.

    There are two particular viewpoints that have led to my interest in this independent observer role.

    • No enterprise software platform is perfect and you should always expect some vulnerabilities.  The issue should not just be on whether there are vulnerabilities, but perhaps more importantly, on how a company or organization responds to a security vulnerability or incident.
    • I have called for transparency from LMS vendors and open source communities, arguing that they should share information from their third-party security audits and tests.

    (more…)

  • Instructure and Security Testing

    Instructure has had a very interesting reaction to the news and blogs about security vulnerabilities with Blackboard’s Learn LMS several months ago.  They have decided to engage Securus Global, the same firm that did the ethical hacking for the Australian universities in the Blackboard investigation, to test Instructure’s Canvas LMS product.  They have also invited me to be essentially an embedded reporter – participating in the process and independently reporting on the testing and Instructure’s response to any vulnerabilities identified.

    While doing research for a my post analyzing Blackboard’s response to the reports of security vulnerabilities, I had the opportunity to interview several LMS vendors to get background on their philosophies and practices around security.  I think it is important to understand how the broader LMS market is handling security concerns, especially as the LMS has become such a central part of the an institutions’ academic operations.

    (more…)

  • What If OpenClass Succeeds in Disrupting LMS Market?

    Right now the e-Literate site is close to over-heating from Michael’s voluminous posts – all very thoughtful, but we’re going to need some WordPress coolant.

    During discussions over the past week in person and over blogs, I’ve had three people ask essentially the same question – will Pearson’s OpenClass LMS offering and associated corporate strategy lead to more competition or less competition in the LMS space for higher ed, or how will the competitive landscape change?  Obviously the nature of this question is speculative with no concrete answers, but I do think that technology market trends can help us with an educated guess.

    (more…)

  • The Sakai/Jasig Merger Plans

    After years of stasis and even atrophy, the educational technology markets are suddenly hot. New LMS players like Instructure are making major wins and market share is shifting rapidly across all the major players. Educational technology startups are sprouting up and getting funded at an unprecedented rate. Blackboard’s announcement of support for producing, discovering, and sharing OERs is the latest of a number of signals that the company is changing. Meanwhile, none of its major competitors are standing still either. Pearson’s OpenClass represents a bold and provocative vision that could upend the whole chess board. Then there are the nextbooks, forging a whole new product category. There was even a “startup alley” at EDUCAUSE for the first time. While rapid change brings about its own problems that we have to be wary of, all of this foment is, on balance, good. We are at an inflection point. The ecosystem is producing new ideas and new possibilities. I am a big believer in the forces of entrepreneurialism and consumerism as twin engines of progress.

    It is with all of this as a backdrop that I would like to explain why I think the recent re-affirmation of the Sakai/Jasig merger is more important than ever and why I have agreed to continue serving on the foundation board of the new entity when the merger is finalized.

    (more…)

  • A Quick Follow-Up on the OpenClass Post

    I’m already getting quite a bit of public and private feedback on my earlier post on Pearson’s OpenClass, and it is all over the map in terms of what people seem to think I was trying to say. This was really a complex topic to try to handle in one post, and I may not have done it justice. So let me lay out a few points as clearly as I can:

    • I think Pearson is trying to create a platform in the way that Google and Facebook are platforms. What I mean is that Pearson will get value not so much from selling their products (although there will definitely be some of that) as from (a) becoming a marketplace for other people’s products (think Apple’s iTunes and App stores) and (b) from getting rich data about student learning needs and behaviors that can enrich both Pearson’s products and those of the third parties that sell through Pearson’s platform.
    • I think there is a lot that is compelling about the idea of such a platform, and that it could deliver improvements to the learning experience that would be difficult to achieve without the kind of scale and centralization that Pearson is trying to create.
    • I also think that a platform approach entails a very different relationship with the vendor than simply licensing a hosted LMS and raises some very serious concerns, including issues of privacy and control over the market for learning content. Schools should make sure they understand the tradeoffs they would be making and discuss them carefully with Pearson (or any other ed tech vendor that brings a platform approach to market) as well as with their peers before jumping in with both feet.
    • Pearson’s marketing efforts have been finely tuned to emphasize free and easy, which I believe is a strategy designed to foster very fast adoption by disrupting the market, starting at the low end and moving up. In doing so, their message emphasizes low cost and ease of use over direct improvements to teaching and learning. In essence, the message is that Pearson will get the LMS (and its price tag) out of the way so that, in Adrian’s words, teachers can focus on “climbing the value chain.”
    • So far, there is relatively little public detail about the product itself. On the one hand, the deep integration with Google Apps is new to the market and suggests that OpenClass will have its own take on things. On the other hand, there is not yet evidence that OpenClass is trying to fundamentally re-imagine what an LMS does or how it does it as a delivery platform. The deeper innovation will likely come from the content marketplace and the analytics, neither of which has been publicly unveiled yet.
    • While Pearson has made what could be characterized as a couple of PR missteps in the introduction, I view these as mostly minor and not indicative of any nefarious intent. Nor am I suggesting that their overall product and marketing strategies are intended to deceive. However, I am suggesting that Pearson will need to raise its game if it wants to foster the kind of trust necessary to build the new customer relationships that it appears to be shooting for.

  • Why Pearson’s OpenClass Is a Big Deal

    The big buzz at EDUCAUSE last week was around OpenClass, Pearson’s new LMS entrant. Much hyped but only rarely glimpsed, speculation has been rampant about whether it is a big deal or just a gimmick. Because most people (including me) don’t have access to the product yet, the best source of information on it at the moment is Adrian Sannier, eCollege’s VP of Product. I had the good fortune to both listen to  him give a presentation on OpenClass and chat with him about it one-on-one. My conclusion is that this product could be a very big deal indeed.

    In a previous post here on e-Literate, Phil Hill characterized OpenClass as potentially disruptive. I think he’s right, but I also think this is one of those times where we have to be careful about how we use that term. Adrian Sannier is a big fan of Clayton Christensen, the man who coined the term “disruptive innovation.” If you really want to understand what OpenClass is all about, go out and read The Innovator’s Dilemma and The Innovator’s Solution very carefully.  There are very specific reasons why “free” and “easy” are the words you will hear most often from Adrian when he is speaking about the product.

    The audacity of what Pearson is attempting should not be underestimated. If they succeed, they could cause major tectonic shifts across several markets that are currently critical to higher education. Colleges and universities need to pay close attention to the kind of deal that they will be striking for themselves. Overall, I don’t think the biggest concern is whether Pearson will fail to maintain the platform as free. Rather, the more serious question is what will they be getting if they succeed.

    (more…)