Unauthorized access

[BarbaraBell]

Has anyone experienced unauthorized access to their Canvas account through external email phishing or hacking attempts? What steps were taken to resolve the issue, and what recommendations do you have for preventing future security breaches?

[chriscas]

Hi @BarbaraBell,

I can't say that I've seen or heard of any attempts against Canvas itself, but it's hard to say with 100% certainty because we use a single sign-on system with required multi-factor authentication (MFA), so phishing attempts pretty difficult to have success with in this case (but i'll admin not impossible).  If your Canvas authentication provider does not have MFA built-in, you could still set Canvas up for that follwoing the info in the How do I configure Canvas authentication details f... - Instructure Community - 257 guide.  That's probably the best advice I could give on the topic right now, along with possibly requiring more complex passwords following the How do I manage Canvas password requirements and l... - Instructure Community - 616519 guide (although this wouldn't really help with phishing).

I hope this helps get the discussion going, as perhaps others will chime in with advice I haven't thought about or heard about yet!

-Chris