AY 19/20 was one for the books for New Mexico Highlands University; fall presented a cyber-attack, spring COVID-19. Despite the cyber-attack challenge, it actually prepared the university for a quick technology response to COVID-19. This session explores leadership and strategic elements that ensure successful navigation in an emergency.
Prior to COVID-19, New Mexico Highlands University (NMHU) experienced a cyber-attack in the fall of 2019. The scale and impact was institution-wide; our entire technology environment was down, and we were not as prepared as we thought. That experience prepared NMHU for COVID-19. In today’s new landscape, how are institutions planning for emergencies? How dependent is your organization on technology? How would you respond if your digital presence were down for multiple days, maybe even weeks? How quickly were you able to transition on-ground classes to distance during COVID-19? The cyber-attack experience resulted in NMHU reviewing their emergency response activities, communications protocols, establishment of priorities, preventative measures, and overall use of technology at NMHU moving forward. This case study will explore not only NMHU’s response to the cyber-attack and how that experience helped prepare NMHU for the COVID-19 response, but the leadership initiatives and strategies established to weather the events.
Session Outline:
I. NMHU overview – 2 minutes
II. Group discussion – 10 minutes
a. Did your institution have an Emergency Operations Plan?
b. Has you EOP been activated prior to COVID-19
c. What role do you think leadership plays in the successful management of an emergency?
d. How well were the strategies for COVID-19 implemented at your institution?
III. Cyber-attack prior – 2 minutes
a. NMHU best practices prior cyber-attack
b. Emergency Operations Plan
IV. Cyber-attack post – 5 minutes
a. Leadership priorities drive response
i. Employees – Ability to process Payroll
ii. Instructional Operations (team make-up)
iii. Faculty Offices
iv. Enterprise Applications – (Brightspace, Zoom, SPSS etc.)
v. Classroom Technology
vi. Open Student Labs
vii. Academic Support
viii. Business Operations
b. Strategy straight forward – 5 minutes
i. Containment and isolation of infection
ii. Eradication or removal of malware and verification of systems, if possible, if not, then replacement system to be put in place in that staff member office
iii. Business Resumption of Presidents priorities – employees, instructional operations and business operations
iv. Strategic - deployment new and preventative advanced IT security industry-wide best practices to prevent reinfection typically associated with ransom/malware attacks
c. Lessons learned from cyber-attack – 5 minutes
i. FEMA Training
ii. Incident Response Team
iii. Action Plan
iv. Establish Priorities
v. Communications Plan
vi. Assessment & Revision
V. COVID-19 Response – 5 minutes
a. Leadership priorities drive response
i. President Minner called an emergency meeting of his Executive Team (NMHU Decision Makers) to established the following priorities or guiding principles:
1. Personal safety (staff and students)
2. Continuity of our core mission – teaching
3. Do no harm or minimize to the maximum degree possible
b. Strategy – 5 minutes
i. Logistics 24/7
ii. Faculty training & support
iii. Student training & support
iv. Digital divide (faculty & students)
1. Students and faculty in remote rural areas
a. Navajo Nation
v. Maintaining operations
VI. Lessons learned – role of leadership and strategy – 5 minutes
a. Executive Management Teams Involvement
b. Emergency Operations Team Activation
c. Setting Priorities
d. Communications Plan
e. Action Plan
IV Conclusion and Q & A – 15 minutes
Engagement Plan:
The session will start with discussion in teams of three with the following question: If your institution has a cyber-attack – is your institution ready and how will you respond? How did your ready was your institution for the COVID-19 and the move to distance? Following the discussion, the case study will then be presented. Discussion from attendees will round out the session with Q & A as well identifying lessons learned.
Learning Outcomes:
Session attendees will:
- Reflect on the institutional leadership’s response to COVID-19;
- Consider your institutional preparedness for emergencies;
- Assess the institutional strategies implemented with COVID-19 – what worked and did not work;
- Explore the importance of a communication plan when the communication network is gone;
- Discuss how to prioritize business resumption and business operations that allow the mission of teaching to continuing when technology is absent or critical to success.