Stopping BEC Attacks Requires a Multi-Layered Security Approach
Business Email Compromise (BEC) attacks strike at the intersection between people and technology, leveraging social engineering tactics rather than technical exploits. By taking advantage of people’s trust and lack of understanding in technology they are able to exploit businesses. Organisations may think their emails are secure, but this new threat uses weaknesses in psychology to undermine their efforts. By their nature, BEC attacks have no payloads, malicious attachments or URLs, that can be detected and blocked, which allows them to evade most existing security technology. Organisations are left vulnerable to attacks and their existing defences rendered useless.
Email is more than ever a challenging entry point to protect as cyber attackers are developing new techniques to evade defences. In recent times organisations have deployed secure email gateways and security training to fight email-born attacks. However, highly focused BEC attacks bypass this security by convincing even secure email gateways that they are from a trusted source. The sending IPs are not on any blacklist and only a few emails will be sent so they don’t trigger alarms like bigger phishing scams might.
Understanding how email gateways work can help organisations grasp how they are unsuccessful at stopping BEC attacks. Email gateways are in simple terms products used to prevent emails with malicious intent from reaching their destination. The gateways can quarantine or block emails that contain specific content. Email gateways are effective at stopping phishing emails, spam and other content which contains malicious URLs. These URLs are either blacklisted or correspond to fraudulent web pages. Similarly, emails with malware can be stopped as gateways pick up attachments or links to malicious content. Malicious content is based on matching a signature or exhibiting unwanted behaviour. The gateways stop many email attacks from reaching their intended recipients and have been extremely effective at their job.
However, BEC attacks often contain none of the malicious content consistent with email blasts with malware. As such, BEC attacks can’t be detected in the normal way by email gateways. Security technologies typically detect BEC attacks because they come from untrusted sources while looking like they come from trusted sources. Warning signs are increasingly undetectable, and attackers are upping their game to ensure they remain as such.
Although some attacks will use malware and therefore might be detected many rely almost entirely on social engineering. They are rarely interrupted by antivirus, spam filters or mailing list permissions. And, what’s more, hackers are persistent. They will continue to contact people within an organisation until they hit a point of weakness. They are also constantly changing their tactics. As we’ve already touched on, they might ask for wire transfers, employee information or intellectual property information. They also choose their targets wisely with a shift away from CEOs to more junior staff making the chances of detection even less likely.
Although Email Gateway vendors have made great strides in attempting to solve this problem, a multi-layered approach to securing the email ecosystem is required for organisations to fully protect themselves. In our next installment of our BEC blog series we will be discussing the emerging technologies that are being developed to fight these types of attacks.
If you would like to find out how InfoTrust can help your organisation solve this problem contact us here.
See our previous post here, which explains the techniques attackers use to execute these BEC attacks.
see our
Related resources
In today’s digital age, we all use a vast amount of information to conduct our business activities, sharing, and interacting with data across multiple devices and networks. As such confidentiality, integrity and availability are key. You only have to look at recent news headlines to realise that even organisations with comprehensive security strategies are still vulnerable to cybersecurity breaches. Vulnerabilities can lie within the technology being used, the cyber-awareness of its employees, and the sophistication of attacks.
There are images of extensive, verbose documents, complex definitions, and eye-watering Excel sheets when the term GRC is mentioned. For the past two decades, GRC has been central to core business processes across many organisations at both ends of the enterprise spectrum, as well as in the small-to-medium business space in recent times.
But the world has moved on; organisations are forced to embrace digital disruption and agility if they haven’t done so whole-heartedly. And this very disruption is positioning GRC to become less-than-ideal to solve the challenges that said disruption brings with it.
Phishing attacks have increased dramatically over the last few years, with the global pandemic escalating the situation further. Cybercriminals take advantage of insecurities and fear and play on human nature to trick and deceive. In fact, according to the OAIC, phishing attacks that involved compromised credentials accounted for 30% of all cyber incidents in the first half of 2021. And human error formed a major source of these breaches. Unfortunately, due to the clever social engineering tactics used by cybercriminals, technical filters alone aren’t sufficient to protect against phishing.
Mimecast recently released its State of Email Security Report for 2021. The fifth edition of its annual report used interviews with over twelve hundred of information technology and cybersecurity professionals across the globe to gather vital cybersecurity insights. The report offers an insight into the latest email threats along with advice on how to build cyber resilience and mitigate the risks of email-borne attacks.
Last month CrowdStrike released its 2020 Global Threat Report, reflecting on the past year’s cybercrime and the types of attacks and techniques criminals have been utilising. In this blog post, we take a look at the key trends from the report and what they mean to Australian businesses.
We're Here To Help