CISSP Cyber Training Podcast - CISSP Training Program · Shon Gerber, vCISO, CISSP, Cybersecurity Consultant and Entrepreneur

CCT 308: Scripted Sparrow BEC and CISSP Incident Response - Domain 7.6

·47 min·3 clips

They use realistic email reply chains to make fake executive approval look real.

1. CISSP Cyber Training Podcast episode CCT 308 centers on Scripted Sparrow BEC activity and CISSP Domain 7.6 incident response. 2. Sean Gerber hosts the episode, identifies himself as the CISSP Cyber Training guide, and says he is also working as a consultant building an incident response process. 3. The episode asks what incident management looks like when a BEC campaign and a broader cyber incident both need a response plan. 4. Sean says Scripted Sparrow is an active business email compromise group that sends millions of emails each month. 5. He says the group shares templates, infrastructure, and techniques across people in South America, Nigeria, Turkey, Canada, and the United States. 6. He says the group targets executive coaching and professional services firms, plus accounts payable and finance teams. 7. Sean explains that finance teams matter because they control money transfers and approval workflows. 8. He describes fake executive approval chains, including email back-and-forth that makes payment requests look authorized. 9. He says the attackers send fake invoices, W-9 PDFs, and ACH or wire transfer requests. 10. He notes that the requests are often kept below approval thresholds, which he says may be around $50,000. 11. Sean says some campaigns now delay sending payment details until the victim replies and confirms engagement. 12. He links that tactic to low attacker cost, especially because email and AI tools reduce effort. 13. He says BEC remains one of the most financially damaging attack types even though it is low-tech. 14. He gives a margin example: a business making 12% on $1 million ends with $120,000 before losses like a $50,000 fraud hit. 15. He argues that small businesses with margins under 10% can be badly damaged by a single payment scam. 16. Sean recommends out-of-band verification, separation of duties, and calling the requester by phone before money leaves the organization. 17. He defines incident response around detection, response, mitigation, reporting, recovery, and remediation. 18. He compares incident lessons learned to a B-1 hot wash after a mission, where the crew reviews mistakes and changes procedures. 19. The episode is instructional and direct, with repeated examples, personal experience, and a steady shift from fraud case study to CISSP process. 20. Listeners who manage finance workflows or study CISSP Domain 7.6 would get the most value.

As heard by us

Practical CISSP detection guidance with a conversational, real-world training feel.

Sean Gerber treats Domain 7.6 as a grounded tour of detection mechanisms, moving from intelligence-feed filtering to IDS/IPS, honeypots, log-based rules, and the simple step of letting employees report phishing.

Read the full review in PlayNext →

Why you'd press play

Want CISSP Domain 7.6 detection controls explained in a working security-mentor voice?

Read the full recommendation in PlayNext →

Listen to the show on

Apple Podcasts Spotify

Play clips from this episode More from CISSP Cyber Training Podcast - CISSP Training Program