Browsed by
Month: December 2022

Metapress: Exposing a Cunning Delivery Scam: An In-Depth Look CDEK

Metapress: Exposing a Cunning Delivery Scam: An In-Depth Look CDEK

Originally published by MetaPress on January 21, 2022. My investigation examines a real-world delivery scam impersonating CDEK. It follows the attack from the initial social-engineering contact through the fraudulent website and payment flow used to obtain victims’ card details and verification codes. The investigation covers domain impersonation, TLS and Cloudflare infrastructure, phishing techniques, fake payment pages, 3-D Secure abuse, and the indicators that helped identify the fraudulent operation. Read the full article on MetaPress →

Streamlining Cybersecurity: SANS Collective Controls Catalog & the Collective Risk Model

Streamlining Cybersecurity: SANS Collective Controls Catalog & the Collective Risk Model

I recently caught a fantastic SANS webcast comparing and contrasting leading IT security standards. The presenters did a great job highlighting the strengths of each, culminating in a “Collective Controls Catalog” that synthesizes the best practices from across the industry. This is an invaluable resource, and I’m grateful to SANS for making it publicly available. You can find it below. Credit goes to SANS for this excellent work. 2022 version of Collective Risk Model (CRM) is born from discussions among…

Read More Read More