Business Email Compromise (BEC) attacks are defined as cybercrimes that employ email fraud tactic to strike a range of targets – from commercial and industrial sectors to governments and non-profit organisations – with the aim of achieving a specific result that negatively affects the target.
The anatomy of a BEC attack
BEC attacks will typically begin with a threat operator craftily spoofing enterprise email accounts so they can pretend to be a company’s legitimate upper management members, or even their Chief Executive Officer. The spoofed email address appears authentic, enabling it to bypass security filters that would typically keep malicious mail from reaching employees.
After circumventing these security gates, the spoof email then reaches its intended recipient. The email appears to be entirely legitimate and so does the request it makes. The hacker behind the BEC attack will usually ask for a payment to be actioned.
As the email looks completely authentic and comes from a trusted superior of the BEC attack victim, they feel completely at ease with complying with the financial request. The hacker behind the attack may ask for a direct transfer of funds, or for a cheque to be deposited. This choice will be informed by information gained on how the company makes financial transactions, and the option requested will be the methods used by the firm.
This is to make sure that the email recipient does not become suspicious and raise the alarm. This type of cyberattack has been modified in recent years with cybercriminals using the scam to obtain not only financial rewards but sensitive enterprise information and employee credentials and personally identifiable information as well. This information can allow hackers to penetrate company networks even deeper and access more confidential content or embed spyware, ransomware, and other types of malicious software to harm businesses.
Security measures advised to avoid BEC attacks
There are some best practices companies can adhere to if they wish to avoid BEC assaults on their staff. These include establishing a company domain and using it to create company email accounts, rather than employing free options that can be spoofed far more easily.
It’s wise to set up all email accounts with multi-factor authentication for more robust security levels. This advanced process for email authentication will request multiple types of information to access company email accounts, and can include biometric data, pass codes and PINs. By establishing this protocol, staff accounts will be far more difficult for attackers to access, reducing the risk of BEC attacks.
Employees must be educated on how to respond to messages sent from unknown senders. These emails should never be opened, and any links or attachments included must not be interacted with as they can compromise your firm’s devices and network.
Powerful protection at your fingertips
At Galaxkey, we have constructed a secure email solution with a select range of tools enterprise professionals can use to operate safely. From state-of-the-art encryption to email validation and tracking, our options can ensure you team can work in a secure environment and keep your company data safe. Contact us today for a free two-week trial.
