Project Description
I am seeking a professional consultation to evaluate and potentially challenge a significant failure in Information Security governance and Incident Response (IR) at a major R1 university.
I am currently navigating a situation involving a persistent, log-evasive intrusion where the institution has leveraged the significant power asymmetry inherent in large bureaucracies to circumvent accountability. I am looking for CISO-level expertise to dismantle a "no record found" defense that was manufactured through intentional administrative delay.
**The core pillars of this case include:**
* **Failure of Notice:** The institution was provided with explicit, immediate notice of a breach and data loss on 11/27. Despite this "on-notice" status, they remained unresponsive for **150 days**, allowing the forensic window to expire.
* **Administrative Misclassification:** Following a formal escalation, the Executive Office misrouted the technical security report to a wellness-focused **"Student Advocacy"** division—a clear departure from NIST SP 800-61 standards.
* **Refusal of Forensic Baselines:** The CISO’s office has dismissed high-fidelity technical indicators (including segment hopping and live data purging) and refused to provide a **managed, monitored device** to establish a forensic baseline, relying instead on server-side logs they allowed to age out.
I am particularly interested in your help to address the **Administrative Attrition** at play here. The university is currently taking advantage of the time and financial burden required for an individual to procure independent forensic oversight. I require assistance in drafting a formal rebuttal to the University’s General Counsel that frames these failures as **Administrative Spoliation** and a breach of the **Duty of Care.**
I have a documented paper trail—including the initial 11/27 notice and the subsequent "Wellness" referral—and would appreciate a brief initial discussion to see if you can provide the expert oversight needed to hold this institution to industry standards.