Skip to main content
CoSN2025 Annual Conference Main banner
View the Promo Video
Classlink
CoSN2025 Welcomes You!
Final Program


Back

Cybersecurity

We Survived a Cyber Incident: From Readiness to Recovery

Wednesday, April 2, 2025
1:30 PM – 2:15 PM PT
Location: 502 / Cowlitz
Cybersecurity

Target Audience: Experienced Ed Tech Leaders/CTO/CIO; IT Manager/Network Administrators; CISO/Privacy/Security Leaders

This story has a happy ending. In January 2024, the “not if but when” happened to us. We’d been cyber-attacked, and the bad guys were in the house.

It started off with a fairly normal outage. Internal sites were stuck, and printing stopped working. We halted all network traffic as we methodically checked possibilities: power, hardware, network servers/services. Then, our Manager of Network and Security found it—a service account doing way more than it should.

He immediately initiated a quarantine, isolating all network traffic, “locking the bad guys in the house” as we began our investigation. The two aims of a cyber threat actor, 1) exfiltrate data, 2) lock us out for ransom, were both mitigated by his quick, informed action. We survived with little loss to operations and no data loss, thanks to our plan. Come hear about the preparation and lessons learned from our first cyber incident.

Key Take Aways:

  • We shape our workshops through Adult Learning Theory, emphasizing the expertise participants bring to the session and making ample space to apply new knowledge to existing problems. They will be reflecting on their own security plans and applying our lessons to their own situations.
  • Have a plan (CIRP). The worst time to figure out your cyber security plan is the day you need one. Call your network and insurance partners NOW to discuss your CIRP, not when it happens.
  • The guts: Know your backups and the backup solution/plan, make sure you’re backing up all servers. Audit admin access regularly. Ensure all accounts and devices, that can be, are locked behind MFA.