Rollercoaster for IT during Canvas crisis: ‘That is when all the alarm bells went off’

Now that Canvas is available again for everyone, the staff involved look back on hectic weeks of hard decisions and high workloads.

Canvas has been fully available to students and staff since Wednesday afternoon. Behind the scenes, several teams worked extremely hard to make that happen.

“They were tense weeks”, says Kenneth Konigferander, deputy director at EDIS, the university’s IT department. “When something happens that you did not expect and that also has a huge impact on the university, that creates many tense moments. That becomes worse when, as a university, you have only limited control over the situation.”

Tense days

There were several tense moments. It began with the first hack discovered in early May, in which the ShinyHunters hackers stole data from 275 million users. “At first, when you see the messages in the media you think: is this really true?”, Konigferander says. “As soon as the supplier confirmed the hack, all the alarm bells started ringing and we switched to crisis mode. We immediately started investigating what the additional risks were.”

At first the damage to the system seemed limited, but on 7 May it became clear the hacker group was still in the system. The threat was therefore far from over. The digital ‘drawbridge’ had to be raised as quickly as possible. “Canvas is connected to other university systems”, Konigferander explains. “The danger was incalculable. That is why we decided to disconnect the platform completely last Friday.”

For Stella Verbrugge-Van den Eshof, head of student administration & courses, who after the second hack was responsible for the configuration of Canvas for Erasmus University, her holiday went differently than planned. Together with a mixed team she mapped out the highest priorities to keep the impact on education as limited as possible. In the end three things proved crucial: communication between lecturers and students, the ability to share study material and the uploading of assignments. “As soon as these priorities were clear, we could act immediately”, she says.

Working together in a crisis

Both stress the importance of working together in times of crisis. By bringing different disciplines together, such as IT, Integrated Safety, education support, communications and faculties, better decisions can be made.

Konigferander: “The university was not the only university in the Netherlands affected. By collaborating with the other universities we were able to make better-informed decisions, because we could use each other’s best practices.”

The joint approach ultimately ensured a quick restart. “The various teams, both inside and outside the university, did extraordinarily good work”, he says proudly.

Verbrugge-Van den Eshof is particularly pleased that the faculties were willing to cooperate immediately. “It’s nice to see how quickly everyone was ready to take action. This allowed us to map out the priorities straight away.”

On Saturday security even came to campus specifically to open the door so the team could start working on a temporary alternative. “That gives you a special feeling.” Despite the high stakes Verbrugge-Van den Eshof also experienced the situation as something positive. “The situation gave me, strange as it may sound, a sense of pride. You feel that together you can really make a difference for education at the moments that count.”

Back online

The moment everything went back online was also nerve-racking. There is never complete certainty that it won’t go wrong again. According to Konigferander the judgment is then: when is it ‘safe enough’ to go fully online again? “As a university do you want to be in the front group, or do you choose to wait a little longer?” This again made clear how important good cooperation and information sharing was.

Importance of good IT-systems

The crisis painfully highlighted how dependent teaching and research are on stable digital services – something that usually remains largely in the background. Together with the other Dutch universities a national evaluation will now take place to draw further lessons, Verbrugge-van den Eshof says.

“We now know even better how to respond to these kinds of situations”, Verbrugge-van den Eshof concludes. “If our IT systems again face such a situation in the future, we will be better able to quickly offer alternatives that work well for students and lecturers.”