Secure Configuration Checklist
System Administrators should consider secure application configuration practices in order to further harden your Blackboard solution.
Identification and authentication
Harden system accounts
Ensure the default "administrator" account password is complex and rotated regularly per your organization's Access Management policies.
Privileges review
Review default privileges assigned to each System Role and Course Role.
Guest access review
Review if Anonymous (Guest) Access is appropriate at all four levels:
System Admin > Security > Gateway Options
System Admin > Course Settings > Course Tools
System Admin > Course Settings > Default Course Settings
System Admin > Organization Settings > Default Organization Settings
Use third party authentication systems
Fully use third party authentication systems such as LDAP and Active Directory. This provides the ability to enforce password complexity policies, obtain login failure throttling, etc.
Disable persistent cookies
Go to System Admin > Content Management > Technical Settings > Authentication Settings
Audit and accountability
Grade History
Enable Grade History.
Do not allow Instructors/Assistants to change auditing status.
Do not allow Instructors/Assistants to clear grade history.
System and communications protection
Enable session fingerprinting
Enable AND Create new session when fingerprint changes.
Note
Bb Mobile users should not enable this setting.
System and information integrity
Configure alternate domain for serving content
Not a default setting because it requires certificates
Tailor safe HTML policy to your needs
Visit Safe HTML Filters.
Review usage of "add/edit trusted content with scripts" privilege
This is similar to privileges review. By default, Administrators and Instructors receive the privilege to use unrestricted HTML. If only a limited set of users need the ability to perform dynamic scripting, consider creating a custom role, placing users into that role, and granting just that role this particular privilege.