Business Email Compromise, or BEC, is one of the most prevalent threats to your business. In this blog, we’ll share why BEC is so successful, and our top tips for preventing business email compromise.
What is BEC?
BEC stands for business email compromise. Threat actors use a combination of techniques, leveraging a compromised mailbox or stolen credentials. Through this, they can create mailbox rules and set up email forwarding. They can also hide the fact that there has been any suspicious activity.
This allows them to use the mailbox for whatever purposes they want, without the user even being aware. With connected cloud applications, the impact can go beyond just your email. Threat actors can also use BEC to gain access to linked applications. An example would be jumping from Outlook to OneDrive or SharePoint. Unfortunately, an email compromise can provide the keys to unlock your business’s sensitive data.
Types of business email compromise attacks
Typically, these attacks are financially motivated. Some of the most popular ways to exploit a compromised mailbox are:
- Impersonating a high-level executive and asking for wire transfers
- Sending fraudulent invoices to vendors or partners, with false payment information
- Trying to obtain banking or sensitive financial information
Top 5 tips for preventing business email compromise
As with all cybersecurity, prevention is the best investment you can make. Being proactive can help you avoid costly security events, as well as reputational damage. The good news is there are many ways to help protect against BEC.
Here are our top 5 recommendations, which combine tools and training to keep your business secure:
Tools and technology:
- MFA: Multifactor authentication, also known as MFA or 2FA, combines something you have with something you know. For instance, a password along with an authenticator app on your phone. This can help if an account is compromised, because the authentication method creates an extra layer the threat actor needs to get through. If you get a security prompt for a login you’re not attempting, chances are something is happening with your account, and you need to reach out to IT. ADNET is such an advocate of MFA, we require it for clients.
- MDR for Email: Having an MDR (managed detection and response) solution in place in your email environment helps protect your business from BEC. This advanced technology reviews emails for threats in real-time, helping eliminate malicious emails. ADNET always recommends our MDR for M365 solution to clients. Microsoft 365 is one of the most heavily targeted platforms because of its massive user base. Protecting your email environment is a small price to pay to help secure your business.
- A managed SIEM solution: Managed SIEM solutions are a great way to be able to take forensic steps. A SIEM solution can help determine how long someone was in a system and where exactly they were. Having audit log capabilities is essential when it comes to recovering from a security event. It’s also required by governing bodies for many types of compliance.
Training:
- Security Awareness Training: Security Awareness Training, also known as SAT, is a preventative measure that helps with many cyberthreats. Training your team on how to recognize and handle threats is a great way to start creating a culture of security mindfulness. Annual security awareness training is essential, and often required for compliance and insurance. ADNET’s training is regularly updated based on current cybersecurity threats.
- Phishing Campaigns: These go hand in hand with security awareness training. Meticulously crafted, hyper-realistic emails are safely pushed out to your team. Customized with your business in mind, the goal is to give you a baseline for how effective your team is at recognizing email threats. Follow up with tailored training based on the results. ADNET’s Security Aware service includes this.
What to do if you believe you’ve experienced BEC
If you believe your organization has been the victim of a business email compromise, engage a trusted partner right away. A great way to start is reaching out to your IT provider. Some IT providers have the skills and tools to assist with this and begin containment efforts, like ADNET.
If your IT provider can’t help, they may refer you to a dedicated cybersecurity firm. ADNET works closely with our partner Cyber74 for advanced security services, and they’re on standby to help our clients with security events such as BEC.
If your MSP can’t help and can’t offer a referral, you may want to reevaluate your IT partnership with them. Cyberattacks are constant, and you should be working with providers who have deep security knowledge and can help you navigate security events.
Need help with your IT or cybersecurity strategy? Reach out to ADNET – we’d love to hear from you.