Get Full Government Meeting Transcripts, Videos, & Alerts Forever!
Get email alerts on the Cybersecurity topic
No spam. Unsubscribe anytime.
UT System strengthens cybersecurity with centralized monitoring, reports 135,000 malicious emails blocked
Summary
Chief information and security officers told the committee the system has centralized security operations, deployed a managed security operations center, and is seeing high volumes of blocked malicious activity while reducing incident resolution times.
University of Tennessee system IT leaders reported investments in centralized cybersecurity tooling and monitoring and shared recent threat metrics with the committee.
Ramon Padilla, system chief information officer, introduced the IT security overview and said the threat environment is constant: an unpatched PC can be compromised within about 20 minutes of connecting to the Internet, he noted. Padilla introduced Dan Harder (chief academic technology officer) and Matthew Williams (chief information security officer), who provided operational detail.
Dan Harder said higher education institutions nationwide have experienced disruptive attacks and cited recent UT metrics: about 32,000 malicious emails blocked in the prior 30 days and more than 28 billion malicious network attempts blocked on the UTK firewall over the same period. He described a shift from campus‑level defenses to a coordinated UT‑wide cybersecurity practice that enabled strategic investments.
Matthew Williams said the system adopted the Center for Internet Security (CIS) Critical Controls as its framework and has engaged a managed security operations center (SOC) operated by Dell to monitor telemetry 24/7. He reported roughly 2,300 notable alerts in the prior 30 days and said the managed SOC handles about 75% of incident closure work, freeing campus teams to focus on maturity and prevention. Williams cited a mean time to close of about 6.9 hours for incidents the team resolved and said the organization is targeting a 15‑minute triage SLA for the most serious alerts.
IT leaders also described proactive email defenses and artificial intelligence tools to block malicious messages: since implementation, the system has blocked about 135,000 malicious emails (the presenters reported the figure for the months since the solution was deployed). Officials said the combined program has raised systemwide security maturity and that they will continue tuning detection and response capabilities.
