Business Email Compromise & Tips To Manage Risk
Business email compromise (BEC) cybercrimes are on the rise, and organisations of all sizes are being warned to be vigilant and take steps to reduce their vulnerability to BEC. Here’s a closer look at what BEC involves, and what cybersecurity steps you can take to protect your business, or what to do if you suspect an attack.
What is BEC?
BEC is a type of email phishing attack where a cybercriminal targets a member of a business organisation in a fraudulent attempt to obtain money or confidential information. The criminal typically poses as a trusted source, and may request payment for a fake invoice or trick the recipient into sending them sensitive data.
The criminal will usually target senior managers or those who are able to authorise financial transactions, and manipulate them into thinking that they are responding to a legitimate request to transfer money to an account operated by a criminal organisation.
BEC attacks are more sophisticated than standard phishing attacks, because the emails are targeted to individuals within the organisation rather than randomly sent to thousands of users in the hope that some will bite. The email is usually carefully composed and may impersonate a familiar contact to create a false sense of security.
BEC attacks often originate from an account that has been hacked and therefore the recipient has no reason to be suspicious of it, and it will bypass any security measures. The email will be crafted with great attention to detail, and all the graphics, signatures, and tone of voice appear to be typical of the organisation it is purporting to be from.
Why should organisations take action on BEC?
BEC is on the rise as the traditional work patterns evolve and more staff work remotely. Over 90 per cent of cybercrime begins with an email phishing attack, so the need to be vigilant and prepared with a risk management strategy for BEC is increasingly important for businesses of all sizes.
The impact of a BEC attack can be devastating for businesses. Most often, it results in an immediate financial loss that may be irrecoverable. It can also seriously impact the reputation of the business as customer trust is damaged and confidential information about the business operation is leaked.
Furthermore, the business may be found to be in breach of the Data Protection Act and may face legal action, and it could be subject to further incidents of identity theft.
How can businesses manage the risks of BEC?
The good news is that all businesses can take steps to protect themselves from BEC attacks. Here are some achievable strategies.
Educate staff in BEC awareness tactics
Conduct regular training sessions to educate staff in the importance of verifying email accounts. Sometimes cybercriminals will hack an account within the organisation to make it appear as if the data or money transfer request comes from a trusted source.
These emails can be very difficult to detect, so emphasise that staff should question the legitimacy of any email that makes a request of this nature. If they have any doubts, they should flag it as spam and contact the IT support services immediately.
If the email is from an external source, the staff member should avoid clicking on any links or opening attachments. Instead, they should contact the organisation directly and ask for verification of the sender’s identity.
Set up advanced email security solutions
There are a number of email security tools available that can enhance the security of your business accounts. Look for features such as Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting, and Conformance (DMARC).
Consider implementing other advanced security systems that can provide real-time analysis of security alerts.
Set up multi factor authentication
Multi-factor authentication requires extra steps to access a business email account, such as a PIN, fingerprint or code as well as a password. This adds an additional layer of security to email accounts and can prevent unauthorised access.
Have a response plan in place
You should have a plan of action in place, so that in the event of a compromise you can immediately take steps to limit the damage. Plan for different types of incidents such as a malware attack, a stolen password, data breach, and so on. Make sure that all staff know who to contact in the event of an actual or suspected incident.