Show Notes
In this video, learn about cybersecurity regulations and if processing CTI could become a potential legal risk. An increasing number of regulations in different countries and regions require data to be processed locally for privacy and national security reasons. But these regulations have potential negative impacts on cybersecurity, such as limiting the sharing of information useful for threat hunting and penetration testing. For example, Europe’s General Data Protection Regulation considers IP addresses – a common indicator of compromise – as personal data. Since 2021, Professor Peter Swire of Georgia Tech’s College of Computing has led a team that has published two papers (linked below) studying the effects of data localization on the provision of cybersecurity services. In this Studio 471, Swire discusses the regulatory environment, how it could impact the use of cyber threat intelligence and what could be done to ensure attackers don’t leverage these changes to their advantage. Participants: Peter Swire, Professor, Georgia Tech College of Computing Jeremy Kirk, Executive Editor, Cyber Threat Intelligence, Intel 471 ---------- Stay in Touch!
Twitter: https://twitter.com/Intel471Inc
LinkedIn: https://www.linkedin.com/company/intel-471/
YouTube: https://www.youtube.com/channel/UCIL4ElcM6oLd3n36hM4_wkg
Discord: https://discord.gg/DR4mcW4zBr
Facebook: https://www.facebook.com/Intel471Inc/
More from Studio 471
Many countries have retired checks as a financial instrument, but billions of checks are still written every year in the U.S. This has proved to be a boon to fraudsters. There is an entire underground industry dedicated to stealing and fabricating checks that is not slowing down and is tricky to combat. Often, images of stolen checks are posted on Telegram and offered for sale to other fraudsters. In this Studio 471, Eric Huber, who is Cybercrime Research Leader at TD Bank, discusses why check fraud is such a huge problem and how financial institutions can counter it. Huber is the curator of the Fraudster Glossary, which is an index of terms used on cybercrime forums. Participants: Eric Huber, Cybercrime Research Leader, TD Bank Jeremy Kirk, Executive Editor, Cyber Threat Intelligence, Intel 471 ---------- Stay in Touch!
Cyber deception involves various techniques to manipulate adversaries, whether it’s baiting them with fake resources or trapping them in frustrating loops. Tim Pappa is a former FBI supervisory special agent who specializes in deception techniques. In this Studio 471, Tim discusses what kinds of threat intelligence can be gained from deception techniques, its limitations, the Bell-Whaley framework and how organizations can start their own scalable deception programs. Participants: Tim Pappa, Incident Response Engineer - Cyber Deception Strategy, Content Development and Marketing, Walmart Jeremy Kirk, Executive Editor, Cyber Threat Intelligence, Intel 471 ---------- Stay in Touch!
Over last several years, clusters of English-speaking threat actors have conducted data breaches on a wide scale. These groups come from an online community known as Com or Community. In the beginning, these threat actors mostly focused mostly on harassing each other, stealing short usernames, cryptocurrency and cheating at games. But then they transitioned into serious data theft, extortion and ransomware. They’ve been intensely investigated by private companies and law enforcement, which have collaborated together to uncover some of their real-world identities and resulted in arrests. In this Studio 471, Michael Fletcher, a former Cybercrime Technical Analyst with the Australian Federal Police, describes the origins of The Com, the tactics used by these threat actors and why they pose a threat to organizations. Participants: Michael Fletcher, former Cybercrime Technical Analyst, Australian Federal Police Jeremy Kirk, Executive Editor, Cyber Threat Intelligence, Intel 471 ---------- Stay in Touch!
Telegram has emerged as a significant platform for cybercriminal activity. Threat actors offer goods and services ranging from payment card details to login credentials to malware and other hacking tools. This ecosystem is vast, and it’s challenging to track. Sayak Saha Roy is an assistant professor at Louisiana State University working on online fraud prevention and usable security. He and several colleagues presented a paper at the Usenix Security Symposium in August 2025 titled “DarkGram: A Large-Scale Analysis of Cybercriminal Activity Channels on Telegram.” The paper describes how the researchers used a language model to identify cybercrime-related posts on Telegram channels with a high degree of accuracy. In this Studio 471, Roy describes how it can be used for cyber threat intelligence research, moderation and more. Participants: Sayak Saha Roy, Assistant Professor at Louisiana State University, Online Fraud Prevention and Usable Security Jeremy Kirk, Executive Editor, Cyber Threat Intelligence, Intel 471 ---------- Stay in Touch!
Structuring a cyber threat intelligence (CTI) program differs for every organization depending on size, the assets it is trying to protect and the threat landscape affecting their particular industry. Kobe Shwartz is the Head of Cyber Threat Intelligence and Analysis at Signify and is also the founder of a consultancy, Underdark.ai. He was formerly a Russian cybercrime and espionage analyst in the Israeli government. In this Studio 471, Shwartz discusses how he started the CTI team at Signify, which was formerly known as Philips Lighting. He also discusses how to manage alert overload, the importance of “Dark Web” intelligence and how to measure return on investment in a CTI program. Participants: Kobe Shwartz, Head, Cyber Threat Intelligence and Analysis, Signify Jeremy Kirk, Executive Editor, Cyber Threat Intelligence, Intel 471 ---------- Stay in Touch!