Cyber Attack to COVID -19: Navigating Emergencies through Leadership and Strategy

Concurrent Session 7
Streamed Session Leadership

Watch This Session

Session Materials

Brief Abstract

AY 19/20 was one for the books for New Mexico Highlands University; fall presented a cyber-attack, spring COVID-19.  Despite the cyber-attack challenge, it actually prepared the university for a quick technology response to COVID-19.  This session explores leadership and strategic elements that ensure successful navigation in an emergency.        


Roxanne has dedicated her career to provide access to higher education having served as an administrator and faculty in the U.S., England, and Germany with a focus on post-traditional populations. She is the provost and vice-president of academic affairs at New Mexico Highlands University, a Hispanic Serving Institution. Previously she was the executive dean of Venango College at Clarion University. She has served in leadership roles that include, academic dean of the College for Professional Studies at Regis University, dean of distance learning as well as a tenured associate professor of Adult Education at Park University, assistant professor of Adult Education at Colorado State University, director of education and training at Hanscom AFB, MA, and assistant education services officer/guidance counselor at Bitburg AB, Germany, and other administrative positions serving first generation, high need students with the TRIO program Educational Talent Search.

Extended Abstract

Prior to COVID-19, New Mexico Highlands University (NMHU) experienced a cyber-attack in the fall of 2019. The scale and impact was institution-wide; our entire technology environment was down, and we were not as prepared as we thought. That experience prepared NMHU for COVID-19.  In today’s new landscape, how are institutions planning for emergencies? How dependent is your organization on technology? How would you respond if your digital presence were down for multiple days, maybe even weeks? How quickly were you able to transition on-ground classes to distance during COVID-19?  The cyber-attack experience resulted in NMHU reviewing their emergency response activities, communications protocols, establishment of priorities, preventative measures, and overall use of technology at NMHU moving forward. This case study will explore not only NMHU’s response to the cyber-attack and how that experience helped prepare NMHU for the COVID-19 response, but the leadership initiatives and strategies established to weather the events. 

Session Outline:

      I.            NMHU overview – 2 minutes

     II.            Group discussion – 10 minutes

                    a.       Did your institution have an Emergency Operations Plan?

                    b.      Has you EOP been activated prior to COVID-19

                   c.       What role do you think leadership plays in the successful management of an emergency?

                   d.      How well were the strategies for COVID-19 implemented at your institution? 

  III.            Cyber-attack prior – 2 minutes

                   a.       NMHU best practices prior cyber-attack

                   b.      Emergency Operations Plan

  IV.            Cyber-attack post – 5 minutes

                  a.       Leadership priorities drive response

                           i.      Employees – Ability to process Payroll

                            ii.      Instructional Operations (team make-up)

                            iii.      Faculty Offices

                            iv.      Enterprise Applications – (Brightspace, Zoom, SPSS etc.)

                            v.      Classroom Technology

                            vi.      Open Student Labs

                            vii.      Academic Support

                           viii.      Business Operations

               b.      Strategy straight forward – 5 minutes

                            i.      Containment and isolation of infection

                            ii.      Eradication or removal of malware and verification of systems, if possible, if not, then replacement system to be put in place in that staff member office

                           iii.      Business Resumption of Presidents priorities – employees, instructional operations and business operations

                           iv.      Strategic - deployment new and preventative advanced IT security industry-wide best practices to prevent reinfection typically associated with                    ransom/malware attacks

                c.       Lessons learned from cyber-attack – 5 minutes

                            i.      FEMA Training

                            ii.      Incident  Response Team

                           iii.      Action Plan

                           iv.      Establish Priorities

                           v.      Communications Plan

                            vi.      Assessment & Revision

V.            COVID-19 Response – 5 minutes

                a.       Leadership priorities drive response

                            i.      President Minner called an emergency meeting of his Executive Team (NMHU Decision Makers) to established the following priorities or guiding principles:

                                   1.      Personal safety (staff and students)

                                  2.      Continuity of our core mission – teaching

                                  3.      Do no harm or minimize to the maximum degree possible

                b.      Strategy – 5 minutes

                              i.      Logistics 24/7

                              ii.      Faculty training & support

                              iii.      Student training & support

                             iv.      Digital divide (faculty & students) 

                                          1.      Students and faculty in remote rural areas

                                                   a.       Navajo Nation

                        v.      Maintaining operations

  VI.            Lessons learned – role of leadership and strategy – 5 minutes

                    a.       Executive Management Teams Involvement

                    b.      Emergency Operations Team Activation

                    c.       Setting Priorities

                    d.      Communications Plan

                     e.       Action Plan

IV        Conclusion and Q & A – 15 minutes

Engagement Plan:

The session will start with discussion in teams of three with the following question:  If your institution has a cyber-attack – is your institution ready and how will you respond?  How did your ready was your institution for the COVID-19 and the move to distance?  Following the discussion, the case study will then be presented.  Discussion from attendees will round out the session with Q & A as well identifying lessons learned. 

Learning Outcomes:
Session attendees will:

  • Reflect on the institutional leadership’s response to COVID-19;
  • Consider your institutional preparedness for emergencies;
  • Assess the institutional strategies implemented with COVID-19 – what worked and did not work;
  • Explore the importance of a communication plan when the communication network is gone;
  • Discuss how to prioritize business resumption and business operations that allow the mission of teaching to continuing when technology is absent or critical to success.