CS Oct 2021

More documents

Recommendations

Info

email spoofing BEC ATTACKS - THE STING IN THE TALE BUSINESS EMAIL COMPROMISE (BEC) ATTACKS ARE FUELLED BY PERPETRATORS WHO RELY ON SOCIAL ENGINEERING TECHNIQUES AND IMPERSONATION - AND THEIR VICTIMS ARE PAYING A MASSIVE PRICE Tim Callan, Sectigo: it is scarily easy to manipulate and falsify business emails in myriad ways. Business Email Compromise (BEC) attacks are a technique where cybercriminals spoof emails to impersonate someone recognised, such as an employee's supervisor, executive or vendor. This is so they can exploit trusted relationships and trick employees into wiring company funds, the sharing of proprietary information or even granting access to the system. As Tim Callan, chief compliance officer, Sectigo, points out, the FBI's 2020 Internet Crime Report i revealed how BEC-related losses increased from some $1.29 billion in 2018 to $1.86 billion in 2020. "Phases of setting up an attack include the initial researching and identifying of targets, and then setting up the attack by performing activities, such as spoofing email addresses," he points out. "In the execution phase of a BEC attack, it could take place in one email or an entire thread, often using language of persuasion and urgency to gain the victim's trust, also including instructions to facilitate making payments to fraudulent accounts. Once the money has been acquired by the attacker, it is quickly collected and disseminated to reduce traceability and retrieval chances." COMMONALITY OF BEC ATTACKS "Virtually every single business relies upon email as a fundamental form of communication, especially in the era of hybrid work, and ironically, it is scarily easy to manipulate and falsify business emails in myriad ways. Cyber-criminals are aware of companies' reliance on them and are perpetrating a variety of attacks to profit from it," adds Callan. The number of estimated business email compromise (BEC) scam attempts that have been perpetrated worldwide from 2017- 2020 ii has risen dramatically, from 9,708 to 17,607 attacks. Additionally, a total of 74% of organisations are not prepared for phishing iii and malware attacks, with the majority of these attacks being carried out through BEC attacks specifically. "Now it is even more concerning that these cybercriminals are recruiting English speakers iv for these forms of attack, making them harder to spot and therefore all the more effective. This will inevitably see more of an increase of successful campaigns, if businesses do not look at ways to spot and prevent the attacks." HOW TO BEST DEFEND AGAINST BEC? As a social engineering scam, employees should be informed how to spot fraudulent emails, advises Callan. "Most businesses are successfully targeted, due to most employees lacking IT-specific technical skills and knowledge. Speed is paramount during an attack, meaning industries must rapidly train their employees to spot and avoid the latest attack vectors." Implementing email certificates is a quick and easy fix to decrease the chances of BEC attacks, combined with ongoing employee training, he points out. "An ideal solution should also integrate with secure email gateways, allowing the gateway to decrypt, encrypt, so that it can continue to deliver on its valuable function. It should provide the recipient better delivery choices and use the native mail client to decrypt the email without leaving the application. CERTIFIED WAY FORWARD "The appropriate certificate type to secure public email is called a Secure/Multipurpose Internet Mail Extension (S/MIME) certificate. These certificates offer a logical approach for preventing business email compromise attacks. With this," he states, "businesses will be able to block malicious actors." ihttps://www.ic3.gov/Media/PDF/AnnualReport/202 0_IC3Report.pdf iihttps://www.statista.com/statistics/820912/numbe r-of-attempts-of-bec-scams-ceo-fraud iiihttps://www.techrepublic.com/article/companiesare-losing-the-war-against-phishing-as-attacksincrease-in-number-and-sophistication ivhttps://www.zdnet.com/article/scam-artists-arerecruiting-english-speakers-for-business-emailcampaigns 34 computing security October 2021 @CSMagAndAwards www.computingsecurity.co.uk
Computing Security Secure systems, secure data, secure people, secure business Product Review Service VENDORS – HAS YOUR SOLUTION BEEN REVIEWED BY COMPUTING SECURITY YET? The Computing Security review service has been praised by vendors and readers alike. Each solution is tested by an independent expert whose findings are published in the magazine along with a photo or screenshot. Hardware, software and services can all be reviewed. Many vendors organise a review to coincide with a new launch. However, please don’t feel that the service is reserved exclusively for new solutions. A review can also be a good way of introducing an established solution to a new audience. Are the readers of Computing Security as familiar with your solution(s) as you would like them to be? Contact Edward O’Connor on 01689 616000 or email edward.oconnor@btc.co.uk to make it happen.
Page 1 and 2: Computing Security Secure systems,
Page 3 and 4: comment POLICE POINT FINGER AT TECH
Page 6 and 7: product review REDKEY USB With all
Page 8: data management ACHIEVING A SECURE
Page 11 and 12: supply chain threats the Gov.uk web
Page 13 and 14: special focus on NI believed they c
Page 15 and 16: advanced threat protection cloud pr
Page 17 and 18: cyber threat intelligence ALL THE L
Page 19 and 20: data impact assurance as a EU GDPR
Page 21 and 22: ackup & recovery "Furthermore, this
Page 23 and 24: ansomware SHOULD YOU PAY THE RANSOM
Page 25 and 26: emote working MASSIVE FLAWS IN HOME
Page 27 and 28: product review ZIVVER SECURE EMAIL
Page 29 and 30: ansomware these would be more valua
Page 31 and 32: ansomware and staying on top of the
Page 33: threat intelligence has not prepare

CS Oct 2021

Create successful ePaper yourself

Delete template?

Save as template?