\n\tBy MARTY LEVINE<\/p>\n
\n\tPitt Digital has already taken a new step to prevent future Canvas hacks, such as the spring incident that targeted more than 100 organizations \u2014 most of them universities \u2014 and caused Instructure, the parent company of the Canvas learning management system, to pay the hacking group \u201cShinyHunters\u201d a ransom to keep the stolen data out of even worse hands.<\/p>\n
\n\tBut fully preventing such future hacks of the software companies so many universities use (such the more recent PeopleSoft breach, also by ShinyHunters, that did not compromise any data or continue further, according to Pitt\u2019s PeopleSoft provider) is a complex issue, said John Duska, Pitt Digital\u2019s chief information security officer.<\/p>\n
\n\tSince those two incidents, Duska said, \u201cPitt Digital turned off students\u2019 ability to create access keys (called API tokens) that let outside apps or scripts connect directly to a Canvas account. These keys are a common target for bad actors because they can be used to pull data without needing a password, so removing this access for students reduces one more way a Canvas account could be exploited.<\/p>\n
\n\t\u201cThis kind of incident tends to push institutions to focus on three things,\u201d Duska added: \u201cMaking sure only the right people and systems have access to sensitive data (the access-key change is one example); more closely scrutinizing the outside companies whose software they rely on; and improving their ability to detect problems quickly when something does go wrong.\u201d<\/p>\n
\n\tAsked for further plans to increase local security, Duska could only reply: \u201cWe generally avoid detailing specific security strategies publicly, since doing so could give adversaries useful information about how to work around them. But these are the general areas institutions like ours continue to invest in.\u201d<\/p>\n
\n\tAsked whether Pitt would benefit from devising its own uniquely designed learning management system, or some sort of Pitt-only version of Oracle\u2019s PeopleSoft, to better fend off hackers who accessed many universities at once through the same software, Duska said: \u201cBuilding and running our own version of these systems, at the level of security that companies like Instructure and Oracle provide, would mean recreating years of specialized software development and dedicated security teams that these companies build up by serving thousands of institutions at once. That kind of scale isn\u2019t realistic for a single university to reproduce \u2014 and a homegrown system would carry its own risk of being hacked, without the added benefit of a vendor\u2019s dedicated security resources.\u201d<\/p>\n
\n\tHowever, he allowed, \u201cno institution can fully protect itself if the outside company providing its software is the one that gets breached. That\u2019s why resilience and fast response matters as much as prevention.\u201d<\/p>\n
\n\tThere\u2019s no specific reason to suggest that the particular student data accessed in the Canvas hack would be used to create stolen identities for anyone in the future, Duska said. \u201cInstructure has confirmed the information taken included names, email addresses, student ID numbers and messages exchanged between Canvas users. There\u2019s no evidence that passwords, dates of birth, Social Security numbers or financial information were involved.\u201d<\/p>\n
\n\tBut, of course, the hacker group that accessed Canvas and PeopleSoft, calling itself ShinyHunters, cannot be taken entirely on its word, he said, despite promises to destroy and not sell data: \u201cThere\u2019s never real certainty when dealing with criminal actors. Because of that, we treat any data that was taken as still being at risk \u2014 regardless of what the attackers claim.\u201d<\/p>\n
\n\tAsked what Pitt had learned from the Canvas and PeopleSoft incidents, Duska said: \u201cIn the Canvas incident, data was taken from Instructure\u2019s systems, not Pitt\u2019s own. In the PeopleSoft incident, Pitt\u2019s environment was scanned by our service provider and no evidence of compromise was found. Either way, a vendor\u2019s incident becomes an incident the University has to respond to \u2014 which is why institutions like Pitt continue to invest in vendor risk assessment, faster detection and monitoring, and clear, fast communication to the community.\u201d<\/p>\n
\n\tMarty Levine is a staff writer for the University Times. Reach him at martyl@pitt.edu<\/a> or 412-758-4859.<\/p>\n \n\t\u00a0<\/p>\n \n\tHave a story idea or news to share? Share<\/a> it with the University Times.<\/p>\n