Canvas LMS handles sensitive educational data including course content, grades, submissions, and personal student information. Comprehensive security hardening should address authentication, authorization, data protection, network security, and compliance requirements.
¶ 1) Identity and Access Management
- Integrate SSO and enforce MFA at identity provider level
- Implement strong password policies and account lockout mechanisms
- Use certificate-based authentication for administrative access
- Regularly audit user accounts and remove inactive users
- Restrict root/admin permissions to a minimal operations group
- Implement principle of least privilege for all user roles
- Review course-level roles regularly for teacher/TA/student privilege drift
- Establish role approval workflows for elevated permissions
- Rotate API and SIS integration tokens on a fixed schedule (recommended: quarterly)
- Force HTTPS and secure cookies for all sessions
- Implement session timeouts for inactive users
- Enable concurrent session limits
- Use strong session encryption keys
- Monitor for suspicious session activities
¶ 2) Network and Infrastructure Security
- Isolate Canvas LMS components using network segmentation
- Keep PostgreSQL, Redis, and background workers on private networks
- Implement firewall rules to restrict access to management interfaces
- Use VPN or private networks for administrative access
- Implement TLS 1.3 for all communications
- Configure HSTS headers with long max-age values
- Use strong cipher suites and disable weak protocols
- Implement Content Security Policy (CSP) headers
- Enable HTTP security headers (X-Frame-Options, X-XSS-Protection, etc.)
- Configure WAF (Web Application Firewall) if available
- Implement DDoS protection measures
- Use rate limiting to prevent abuse
- Enable health checks to detect compromised instances
¶ 3) Data Protection and Encryption
- Encrypt databases containing grades and submissions
- Use encrypted file storage for course materials and user uploads
- Implement transparent database encryption (TDE) for PostgreSQL
- Encrypt backup files before storage
- Ensure all communications use TLS encryption
- Encrypt replication traffic between database nodes
- Use encrypted connections for Redis and other services
- Implement client-side encryption for highly sensitive data
- Encrypt backups containing grades and submissions
- Store backups in secure, access-controlled locations
- Implement backup integrity verification
- Regularly test backup restoration in isolated environments
¶ 4) LTI and External Integration Governance
- Approve LTI tools through a formal security review process
- Limit LTI scopes to required capabilities only
- Implement LTI 1.3 with JWT signing for enhanced security
- Validate and sanitize all LTI parameters
- Remove inactive LTI tools and stale developer keys
- Audit outbound data sharing to third-party providers
- Monitor LTI tool usage and data access patterns
- Implement API rate limiting to prevent abuse
- Use OAuth 2.0 with PKCE for API authentication
- Regularly rotate API keys and tokens
- Implement API access logging and monitoring
- Validate all API inputs and sanitize outputs
¶ Code and Dependency Management
- Track Canvas and dependency updates on a predictable patch cycle
- Subscribe to security mailing lists for Canvas LMS updates
- Perform regular dependency vulnerability scans
- Use signed releases and verify checksums during updates
- Maintain separate staging environments for security testing
- Implement strict input validation for all user inputs
- Use parameterized queries to prevent SQL injection
- Sanitize all user-generated content to prevent XSS
- Implement file upload restrictions and virus scanning
- Validate file types and sizes for uploads
¶ Logging and Monitoring
- Enable audit logging for security events
- Monitor authentication attempts and failures
- Track administrative actions and configuration changes
- Log LTI tool access and data sharing events
- Implement real-time alerting for security incidents
- Regularly review logs for suspicious activities
¶ 6) Compliance and Governance
- Implement FERPA compliance measures for student data
- Ensure GDPR compliance for EU citizen data
- Follow institutional security policies and standards
- Maintain documentation for compliance audits
- Implement data retention and deletion policies
- Conduct regular penetration testing
- Perform vulnerability scans regularly
- Review security configurations periodically
- Update security policies based on threat intelligence
- Train staff on security best practices
# Check for known vulnerabilities in dependencies
bundle exec bundle-audit check --update
# Scan for security issues in configuration
bundle exec rails_best_practices .
# Verify security configuration
bundle exec rake canvas:check_security_settings
# Test authentication and authorization
bundle exec rake canvas:test_authentication
Any questions?
Feel free to contact us. Find all contact information on our contact page.