e-Literate

Present is Prologue

Tag: Instructure

  • Analysis of Instructure Security Testing

    Instructure has engaged Securus Global to test the Canvas LMS product for security vulnerabilities. Instructure also invited me to be an independent observer – participating in the process and independently reporting on the testing and Instructure’s response to any vulnerabilities identified. Part 1 of this series of posts described the concept. Part 2 gave a mid-term update, describing the process involved and initial results. Part 3 described the full results of the security assessment. In this final post on the experience I’d like to address two subjects – my own impressions of the testing, and a call for more LMS vendors to follow suit and make their security testing more transparent.

    Results Themselves

    As described in part 3, the risk assessment found 10 vulnerabilities – 1 critical, 1 high, 4 moderate and 4 low risk – in the Canvas LMS system. I do not have a basis to judge the relative number of vulnerabilities found compared to Instructure’s competitors, as there is not an industry-specific standard on the depth and extent of penetration testing, but by all appearances the Canvas LMS system is a well-designed, generally secure application. I base this judgment on two factors:

    (more…)

  • Instructure Security Assessment Results

    Instructure has engaged Securus Global to test the Canvas LMS product for security vulnerabilities.  Instructure has also invited me to be an independent observer – participating in the process and independently reporting on the testing and Instructure’s response to any vulnerabilities identified.  Part 1 of this series of posts described the concept.  Part 2 gave a mid-term update, describing the process involved and initial results.  In this post I’ll describe the full results of the security assessment.  I’ll add my actual analysis in the final post.

    The purpose of the testing was to validate and review the Canvas LMS design and implementation with respect to vulnerabilities that could be exploited by a motivated hacker.  Securus employed security experts to ethically hack, both manually and with automated tools, a test environment to try and identify specific vulnerabilities, working from the perspective of both an unauthorized user and an authorized user.  There was a range of exploits tested, but the basic idea is to find out if someone could access information or functionality that should be protected by system controls including role-based security.

    Summary of Findings

    The findings were presented to Instructure on November 29, 2011 in report form and with a conference call to discuss.

    (more…)

  • Instructure Security Mid-Term

    Instructure has engaged Securus Global to test the Canvas LMS product for security vulnerabilities.  Instructure has also invited me to be an independent observer – participating in the process and independently reporting on the testing and Instructure’s response to any vulnerabilities identified.  Part 1 of this series of posts describes the concept.  In this post, I’ll give a mid-term update, describing the process involved and initial results.  In the next post I’ll describe the full results of the security testing.  I’ll try to keep my actual analysis in the final post, after I have objectively described the process and results.

    The purpose of the testing was to validate and review the Canvas LMS design and implementation with respect to vulnerabilities that could be exploited by a motivated hacker.  Securus employed security experts to ethically hack a test environment to try and identify specific vulnerabilities, working from the perspective of both an unauthorized user and an authorized user.  There was a range of exploits tested, but the basic idea is to find out if someone could access information or functionality that should be protected by system functionality including role-based security.

    There are two particular viewpoints that have led to my interest in this independent observer role.

    • No enterprise software platform is perfect and you should always expect some vulnerabilities.  The issue should not just be on whether there are vulnerabilities, but perhaps more importantly, on how a company or organization responds to a security vulnerability or incident.
    • I have called for transparency from LMS vendors and open source communities, arguing that they should share information from their third-party security audits and tests.

    (more…)

  • Brown University moving from Blackboard to Instructure’s Canvas LMS

    This is a guest post by Phil Hill from Delta Initiative, follow on Twitter  @PhilOnEdTech or his blog

    Brown University announced today that they will be moving from MyCourses, which is their branded version of Blackboard Campus Edition (formerly WebCT), to Instructure’s Canvas LMS.  They have already been piloting the Instructure system, and plan to fully move into the new system by Spring 2013.  The Computing and Information Services (CIS), aided by the Academic Technology Steering Committee, started the move to replace MyCourses after Blackboard announced it would end support for Campus Edition by October 2012.  Brown University had been on the WebCT / Blackboard system since 2002.

    (more…)

  • The Changing Dynamics of the Educational Technology Markets

    Phil Hill has two good blog posts up in response to Blackboard’s announcement that it has received at least two “unsolicited non-binding proposals” for the company to be acquired. In his first post, Phil argues that, whatever the outcome of the bidding, Blackboard’s brand value will be hurt:

    In one dramatic shift, Blackboard has gone from the known to the unknown.  For years, one of Blackboard’s greatest sales strength was the message that it was here to stay.  Unlike that pesky Desire2Learn, who might succumb to lawyer’s bills and the patent fight, Blackboard was a solid investment with the corporate muscle to be here for the long haul.  Unlike those pesky open source providers, who might disappear or stop developing, Blackboard presented “one throat to choke” and was reliable.  Now, can anyone reliably guess what’s going to happen to Blackboard, who will provide services, whether the roadmap will completely change?

    This sales advantage is now gone.

    I’m somewhat agonistic on this point. I see Phil’s argument, but the size of the impact may be significantly different depending on whether the acquirer somebody like McGraw Hill, somebody like News Corp., or if no acquisition comes through (which I think is the most likely scenario). I don’t have a strong gut feeling about how much this changes the sales conversation.

    In his second post, Phil takes issue with one of my previous posts:

    Michael is right and you should read the whole post and its second part, but I have a different opinion on the conclusions.  I agree with the conclusions that…

    by 2014 we may see it beginning to change the whole picture for educational technology infrastructure in some fundamental ways. Buckle up, folks. It’s going to be an interesting ride.,

    but I am less inclined to rely on straight-line projections of market data to look ahead, and am more inclined to think the market changes we are seeing are driven by outside forces with potentially nonlinear effects.  Rome may have been weakened from within, but when real change happened, the Visigoths made it happen….

    Today, there is a flood of new money into the educational technology market.  In addition to the potential acquisition of Blackboard, Instructure just raised $8M in venture funding and vying for the role of Alaric in their marketing position, Pearson has been heavily investing in Learning Studio (eCollege for you old-timers), and Moodlerooms raised $7+M in venture funding.  Publishing companies, ERP vendors, private equity, venture funding – these are major disruptive forces.  And there is still significant moves being made by technology companies such as Google.

    Whatever happens with the potential acquisition of Blackboard, expect to see a different market emerge, with new dynamics.  For higher education institutions – is your academic technology strategy ready to handle the changes in the market?

    I’m not sure that we actually disagree. I also believe that there are some pretty massive changes taking place in the educational technology markets. The only question I would raise is whether those changes will hit quickly enough to substantially change the likely outcome of the evaluations that WebCT and ANGEL customers are going to have to complete in the next 24 months.

    Let’s dig into the details a little and see what we can figure out.

    (more…)

  • Desire2Learn Drops UEN Suit

    I was able to speak with Desire2Learn Director of Marketing John McLeod to confirm that his comment on my previous post means what it appears to mean:

    All vendors enter every RFP process with the view that the process will be fair and equitable. We all invest resources to respond to RFPs, make presentations, and demonstrate our capabilities. In virtually every case, we accept the decision.

    Michael is correct, Utah law requires that a protest be made within 5 days of a decision, and an appeal – which must be filed in court – be made within 14 days of a denial. We have requested materials under Utah’s freedom of information laws. We will carefully review the materials when we receive them to better understand this process.

    Out of respect for institutions in Utah and our desire to concentrate on serving our customers, we are immediately dropping this appeal. We want to reassure everyone that our focus continues to be on improving education.

    On the phone, John re-iterated that Desire2Learn’s motivation was to better understand the decision-making process and making sure that it was fair.

    It would behoove colleges and universities to become more sophisticated about this sort of thing. On the one hand, ethics laws exist for a reason and, as one commenter on the previous post noted, it is perfectly reasonable for a company to want to ensure that those ethics laws were followed. (I recommend reading the whole comments thread, by the way; the range of perspectives is interesting.) On the other hand, these challenges definitely get abused sometimes. So it should be routine for schools to share information about these sorts of things when they happen, but also to be careful to get all the facts. Every situation is different.

    In fact, this whole situation might have played out differently had more of the details of the process been pro-actively published in the first place. That’s not a criticism of UEN; I recognize that there are all kinds of reasons why it is difficult (and sometimes even legally impossible) to share some of this. But in general, I do think that schools would benefit greatly by taking a position of publishing all evaluation process information by default and only making private what needs to be private, rather than the other way around. This change would require some non-trivial rethinking of processes and policies, as well as significant extra work, but the end result would be better contract negotiations based on shared data and best practices from peer schools as well as fewer (though higher quality) challenges after the fact.

  • Desire2Learn Sues UEN Over Instructure Contract

    This was reported in The Salt Lake Tribune and, more recently, in The Chronicle of Higher Education. As I have mentioned here previously, startup LMS developer Instructure recently won an LMS bid for the 140,000-student Utah Education Network (UEN).  Now, UEN, as a consortium of public schools, is bound by state laws regarding contract bidding. In their complaint, Desire2Learn alleges that (a) an employee of Instructure had been an employee of UEN or one of its membership schools at the time that the selection criteria were created and was involved with their creation (which would presumably be a violation of state conflict of interest laws) and (b) that UEN didn’t follow the selection criteria published in its RFP (which would presumably be a violation of the state’s procurement laws).

    These suits are a lot more common than most people realize. They usually happen either (a) because there genuinely was an unfair selection process (which definitely happens) or (b) because the litigating company is just using the lawsuit as a competitive bludgeon (which also definitely happens). It’s not immediately clear from the publicly available data which might be the case here. Certainly, nothing I have seen or heard yet comes remotely close to being a smoking gun regarding misconduct in the selection process. But there’s not much that’s publicly available yet.

    Here’s what we do know that should put some context around this:

    • According to Utah state law, if a company thinks there was something amiss with an award process, that company has five days to file a protest with the organization that granted the award.
    • Desire2Learn did file a protest within five days.
    • If the protest is rejected, then the challenging company has fourteen days to file an appeal.
    • UEN did reject D2L’s protest, and D2L did file for an appeal within fourteen days.
    • In order to get access to the kind of information that would, in fact, show whether there had been any hanky panky in the selection process, you’d need to request the process documentation from UEN via Utah’s Government Records Access and Management Act (GRAMA), which is the state’s equivalent to the Federal Freedom of Information Act.
    • Given the way these bureaucratic information request processes go, it is very likely that any company that thinks there might have been misconduct would have to file suit before it was able to gain access to the information that they’d need to prove it. This encourages a practice of filing a placeholder lawsuit before the facts are in.

    Based on the above, it might not make sense to read too much into this lawsuit at this point. At the moment, all we can be sure of is that Desire2Learn is preserving their right to challenge the decision. We won’t really get a sense of the true nature of the suit or the motives of the company until we get a few more moves into the chess game. I will report on the developments as I learn more.

    As a side note, I think it is important for these sorts of challenges to be more widely known in the education community whenever they happen, for transparency’s sake. If anybody is aware of such challenges taking place, please let me know.

    I have published both Desire2Learn’s protest and UEN’s response below the fold.

    (more…)