How Should Higher Ed Institutions Respond?
Canvas is a popular learning management system in higher education. On EdTech reports that in 2023, Canvas held 41% of the U.S. market share by institution count, and 50% of the market share in 2024 when scaled by enrollment. The Canvas breach is a third-party risk event, and remediation must be treated accordingly, says Walt Powell, lead field CISO at CDW.
“Treating it like a traditional campus security failure will lead institutions to focus on the wrong remediation,” he says. “The right question is not only, ‘How do we harden Canvas?’ but, ‘What does our exposure footprint look like given what we put into Canvas and connected to Canvas?’”
Powell says institutions should map their risk across two axes: data residency and integration risk.
DISCOVER: Learn five ways to boost cybersecurity maturity in higher education.
On the data residency side, institutions need to determine whether Canvas contained Family Educational Rights and Privacy Act-regulated records, personally identifiable information, advising communications, accommodation-related communications, research-related course data, student conduct communications, graduate program communications, faculty-student messages, or operational communications.
On the integration side, institutions need to map student information system, single sign-on tools, Learning Tools Interoperability tools, developer keys, Canvas Data 2 pipelines, analytics platforms, data warehouses, identity providers, digital content vendors, plagiarism tools, proctoring tools, video platforms and custom middleware.
Affected institutions should confirm notification status, preserve logs, validate SSO and Canvas admin activity, review developer keys and tokens, inventory LTI tools, validate SIS and Canvas Data 2 pipelines, assess data notification obligations, and prepare targeted communications.
READ MORE: Continuous threat exposure management proactively monitors IT environments.
“The first days are about containment, validation, communications and academic continuity,” Powell says. “The first weeks are about exposure mapping, vendor accountability, legal and regulatory review, and integration validation. The next months are about SaaS governance, data minimization, third-party risk, contract remediation and tabletop exercises.”
“CDW can help higher ed institutions build a SaaS exposure register, assess identity and integration risk, support vendor risk reviews, evaluate third-party risk program maturity, map data flows, review incident response readiness, and develop executive-ready communication materials,” he adds.
