Cyberattack now teaching tool

Lesson plans come to life at Regis, where IT services were struck by “malicious threat”

Two weeks before a “malicious threat” crippled Regis University’s information technology services — rendering the Denver campus’ phones, email and internet useless just as summer courses ended and the fall semester began — Bob Bowles was teaching students how to respond to a cyberattack.

“Once an incident happens, the first thing you want to do is contain the damage, stop the bleeding,” said Bowles, a cybersecurity professional of more than 20 years who is now the director of Regis’ Center for Information Assurance Studies. “Go into ratification and recovery phase — determining how it happened, patching the weakness and trying to put controls in place.

“Then you come up with lessons learned,” he said. “Every incident is unique. Even if you did it perfectly in terms of response time and recovery, you always wonder what worked well, what didn’t work well. It’s a continuous cycle.”

Bowles and the rest of Regis’ cybersecurity faculty have witnessed their lesson plans come to life since the attack two weeks ago that continues to wreak havoc on campus technology services. Although the academics aren’t on the front lines fighting the intrusion, leaving that job to IT services and forensic investigators, the educators are taking notes.

They plan to use the attack as a case study in their own classrooms and as a lesson for others in the community.

“It’ll have an impact outside of our cyber programs as well, I’m sure,” Bowles said. “There’s more of a community focus. Everybody wants to help because it’s not like you’re isolated. If government or private industry gets hit, it affects us all. I see the information sharing happening so much more.

“Whenever there’s an incident where somebody suffers a loss, if we can all learn from those events and better prepare ourselves, that’s one of the good things I can see that’ll come out of this.”

Shari Plantz-Masters, dean of Regis’ College of Computer and Information Sciences, said the university plans to hold an invitational conference when the situation is resolved to talk about what they learned and help prepare others.

“We’ll be able to analyze what we did well, what we could have done differently, how we’re going to move forward,” Plantz-Masters said.

Cyberattacks are becoming increasingly common, with nearly two dozen Texas cities last month hit by hackers who took down or otherwise crippled computer systems while demanding ransom