Studio 471

The advent of cybercrime-as-a-service – where cybercriminals create tools and products for use by other cybercriminals – has revolutionized online crime, allowing it to scale and become more effective. The discussions and products in underground forums and marketplaces can give clues as to how cybercriminals are exploiting and profiting. But these markets can be sprawling. Extracting useful cyber...

Australia holds regular attack simulation exercises to test the cyber resilience of the financial services sector. These exercises, called Cyber Operational Resilience Intelligence-led Exercises (CORIE), are designed to be as realistic as possible, drawing on targeted cyber threat intelligence to create attack scenarios. By using tactics, techniques and procedures (TTPs) that match active threat g...

In this video, learn about cybersecurity regulations and if processing CTI could become a potential legal risk.  An increasing number of regulations in different countries and regions require data to be processed locally for privacy and national security reasons. But these regulations have potential negative impacts on cybersecurity, such as limiting the sharing of information useful for threat hu...

In this video, learn about the rise of Russian cyber crime with U.S. Department of Defense Analyst, Alec Jackson.  At a state level, Russia is a top-tier cyber power, with capable advanced persistent threat groups. It is also the source of a significant amount of underground cybercriminal activity. That activity is a product of its strong educational systems but poor economic opportunity for IT pr...

Learn how to share threat intelligence with ISACs from Sydney Johnson to help lower the risk of a cyber attack.  Sharing threat intelligence is crucial for helping organizations defend against current threats. But there’s always been reluctance about sharing indicators, ranging from worries about trust to revealing too much information about threats targeting an organization. Sydney Jones is Head...

Learn how cyber insurance policies help reduce the risk of potential financial cyber attacks with Sezaneh Seymour from Coalition Inc.  Cyber insurance policies are a way organizations can mitigate financial risk from cyber incidents. But these types of policies are quite different from house or car insurance, and some insurers approaching these risks in unique ways. Tech-focused insurer Coalition...

Learn about ransomware attacks and how to calculate the impact of an attack on an organization.   The costs of ransomware are high, but experts struggle to calculate the true impacts due to a lack of reporting requirements. Additionally, organizations affected by ransomware often do not want to discuss incidents for many reasons, ranging from legal to reputational to the distressing effects of bei...

Learn cybercrime techniques with MITRE Corporation and see how their ATT&CK framework helps them protect their systems from cybercriminal groups.  Over the last decade, the MITRE Corporation has grown its ATT&CK framework, which is a knowledge base of adversary behaviors that can help defenders in a variety of ways. MITRE has traditionally been focused on Advanced Persistent Threat (APT) g...

Diana Selck-Paulson is the lead security researcher at Orange Cyberdefense, which is a managed security services provider that serves a worldwide client base. Her background in the social sciences as a criminologist with a specific focus on cybercrime has given her unique insight in the cybersecurity challenges facing organizations. In this episode of Studio 471, we discuss two areas where Orange...

Learn how to build your own cyber threat intelligence program that keeps stakeholders happy as well as understand the Cyber Threat Intelligence Capability Maturity Model.  Starting a cyber threat intelligence program (CTI) prompts many questions: What intelligence is most useful? Where are the data sources? How can you satisfy stakeholders? And ultimately, how you demonstrate that a CTI program pr...

If you’re the buyer of security products for a large company, how do you ensure that a product works as promised? Security software testing puts products such as firewalls, endpoint protection and intrusion detection systems through their paces. But security software testing has been a contentious area, with vendors sparring over results and occasional accusations of cheating.  In this edition of...

Learn about how vulnerability management, the KEV list, and threat intelligence can help with patching.  Patching remains one of the most difficult security tasks organizations face. Zero-day vulnerabilities may catch the headlines, but the truth is most organizations are caught out by n-day vulnerabilities where patches have been available for some time. The U.S. Cybersecurity and Infrastructure...

Listen to Mandiant's year review on ransomware and extortion and see how it impacts organizations and victims.   Mandiant, which is now owned by Google Cloud, is one of the top-tier incident response and forensics firms. It has visibility into some of the most prominent intrusions, data breaches and ransomware attacks. In this edition of Studio 471, Mandiant CTO Charles Carmakal says half of all r...

Learn about the Ransomware Task Force’s progress in combating cyber extortion, as Megan Stifel shares insights on strategies, ransom policies, and security improvements. The Ransomware Task Force was created in 2021 to bring together government, private industry and civil society to create strategies to fight cybercriminal gangs extorting organizations. This year has been challenging with rising a...

In this video, learn about the evolution of ransomware attacks.  Ransomware attacks have sharply increased in 2023, and payments to ransomware gangs and affiliates are nearing all-time highs. With law enforcement and governments sharply focused on disrupting and imposing costs on ransomware groups, why is ransomware stubbornly sticking around? In this edition of Studio 471, Jacqueline Burns Koven...

Discover how strong authentication methods, such as biometric and device-based verification, can prevent credential reuse and significantly improve security against cybercriminal threats. Access credentials and session tokens are among the most popular illicit digital products in underground digital marketplaces. The reuse of credentials is often the starting point that leads to a data breach and...