There are many types of cyberattacks that your IT support provider in Southern California should know about, and one of these attacks is called the Business Email Compromise (BEC). It involves a hacker impersonating a company executive to mislead employees, vendors, or customers to gain access to sensitive information. Here are ways your IT team can protect your enterprise from a BEC:
How Attackers Use Deception
The reason your IT support provider in Southern California should be aware of BEC, also known as a “man-in-the-email” attack, is that it’s easy for people to be fooled by it. An employee, for example, might think they are actually communicating with their boss in an email and then fall into the trap of exposing something valuable like a company credit card number.
The attacker is able to be deceptive by first researching information about the target. They become familiar with the company website, staff contacts, and press releases before launching an attack, typically on an executive account. Armed with deep knowledge about the company, the hacker can convincingly pose as an insider in an email.
Once the hacker penetrates an email account, he or she can change settings such as the reply-to address so that the owner is not alerted by account activity. An attacker may also deceive recipients by using a spoofed domain which is one character different from a familiar domain and easy to overlook.
Educating Your Staff
It is imperative that you and your IT team make each of your employees aware that they must be cautious of what they click in an email. Let them know that BEC-style phishing attacks are among the costliest in damages to a company. If workers are not trained to watch out for cyberattacks, they may end up contributing to the problem rather than the solution. Many phishing attacks are a result of employee errors.
More BEC scams to watch out for are when a hacker sends fraudulent invoices to customers or vendors requesting a payment to the criminal’s account, or when the hacker pretends to be an attorney and sends messages to clients asking for payment right away. Scammers who continue to get away with this technique potentially end up extracting millions of dollars from suppliers after a few years. In some cases, attackers may be more interested in trade secrets than money.
How to Prevent Business Email Compromise
The key to stopping BEC attacks is to prepare for them. Unsuspecting employees falling for social engineering isn’t the only factor that enables these attacks. Your system may not have enough layers of security, making it more vulnerable to outsider penetration. Here are steps to take to protect your digital assets:
- Develop strict access policies
- Use multi-factor authentication such as a password + pin number
- Train employees to identify fraudulent emails
- Constantly monitor your network with malware detection software
- Consider virtualization, which can limit the impacts of breaches
Make sure your IT support provider in Southern California cares about protecting your business from cyberattacks. Otherwise, move on to a more experienced and knowledgeable IT team. To learn more about cyber security, contact us at ecasys and let us protect your data and applications from attacks.
