The Single Transition Document That Unraveled a Supply Chain Investigation | Isaac Straley | EP #18

Isaac Straley is CISO at the J. Paul Getty Trust and formerly served as CISO at the University of Toronto, where he helped build CanSSOC, Canada's first shared security operations center across universities and colleges. Higher education might be the hardest place to do security. You cannot mandate anything. Policy means almost nothing without buy-in. And the people you are trying to protect are grad students filing taxes at the last possible second because that refund is how they pay rent. In 2008, Isaac started getting phone calls. Not alerts. Not system flags. Students calling him directly saying someone had already filed their tax return. What started as a handful of phone calls turned into a criminal investigation, a cross-country flight, and a fake tax processing office that had monitors and keyboards and absolutely nothing else inside it. He has been thinking about that case for 18 years. And it still shapes everything he builds. What we cover in this EP: ◼ Why security in higher ed runs on peer influence rather than authority and what that actually demands from a CISO ◼ How six Canadian universities pooled threat signals and started blocking attacks across institutions in minutes ◼ The 2008 grad student identity theft case: one phone call, 150 victims, a fake tax front, and one document nobody knew still existed ◼ When the breach belongs to your vendor but the students still come to you ◼ Why your playbook will break on every real incident and why that is the most valuable thing that can happen Timestamps: (00:00) – Trailer (01:04) – Isaac's background and the higher ed security landscape (03:16) – Why policy carries no weight at a university (06:35) – Real technical differences versus people who just want to do it their way (10:06) – How CanSSOC started and why six universities could not go it alone (13:25) – Shared threat feeds blocking attacks across institutions in minutes (18:29) – Peer reviewed command and control: influence that actually moves people (22:31) – 2008: students report tax fraud before any alert fires (26:10) – Isolating the cohort and following the data everywhere it went (29:39) – Communicating with victims when the picture is still incomplete (36:35) – The evidence that pointed to a third party supplier (39:29) – A fake tax front, a subpoena, and a document nobody knew existed (45:12) – Your playbook will break and that is the point (52:36) – Supply chain vetting and why contracts are the floor not the ceiling (1:01:42) – Citizen Lab, nation-state attention, and high-risk research (1:08:29) – How to map threats you cannot fully see yet Guest ⬇️ Isaac Straley:   / isaac-straley   Hosts ⬇️ Alex Paguis:   / alex-paguis-53a21815   Yegor Sak:   / yegor-sak-725330b2   Powered by Control D