Notice: Instructure Security Incident & Canvas Updates

Yale ITS is monitoring a reported cybersecurity incident affecting Instructure, the vendor behind Canvas. At this time, there is no known significant impact to Canvas services at Yale, and updates will be shared as more information becomes available.

Read More

Critical vulnerability in all versions of Linux.

Critical vulnerability in all versions of Linux. Please check with your vendor for updates and plan to apply patches as soon as possible. For more information, see: https://xint.io/blog/copy-fail-linux-distributions

Read More

YALE-MSS-13.4: Collect and review all system activity logs

Standards Group:
YALE-MSS-13: Logging

YALE-MSS-13.4: Collect and review all system activity logs

Low Risk Endpoint Not Required Moderate Risk Endpoint Not Required High Risk Endpoint Not Required Low Risk Server Not Required Moderate Risk Server Required High Risk Server Required Low Risk Mobile Device Not Required Moderate Risk Mobile Device Not Required High Risk Mobile Device Not Required Low Risk Network Printer Not Required Moderate Risk Network Printer Not Required High Risk Network Printer Not Required

Details

The ongoing capture and review of system events is critical for monitoring system health and detecting/responding to security issues. In some cases, external obligations such as HIPAA and PCI may also require this.

In all cases, regularly inspecting event logs is an effective means of checking the status of a system and its resources.

For more information about HIPAA and PCI, please see:

One approach for collecting and reviewing logs is a mix of automated and manual activities:

  • Once a day, event logs are filtered by an automated tool; important events are flagged and sent to system administrators for review
  • Once a week, system administrators manually review a summary/dashboard of recent events, further exploring those events that warrant a closer look

Adjust the process and timeline as needed based on risk, resources, and feasibility.

Tools to facilitate gathering and monitoring event logs are often built into a given OS, but also exist as open source and commercial software.