Strategies To Protect Your Business From BEC Attacks

Cybercriminals are constantly becoming more sophisticated, and making use of a huge range of different techniques and tactics. Worse, it is getting more common.

Phishing emails are still a constant source of problems, as are ransomware attacks and data breaches are still unfortunately common. But, despite this wide range of cyber attacks, you might be surprised to learn that nearly half of all cybercrime’s financial loss comes as a result of Business Email Compromise (BEC) attacks. Indeed, a shocking 42% of all cybercrime loss was recently attributed to BEC.

Evidently, global businesses need to take BEC attacks very seriously. So, here we take a look at how BEC attacks are performed and what businesses of all sizes can do to minimize their risk of falling victim. 

What is a BEC Attack?

A form of phishing attack, BEC attacks differ in that while phishing attacks are generally sent out to a very large number of people, BEC attacks are highly targeted. Sometimes known as man-in-the-email attacks, they generally take the form of a hacker either taking control of a legitimate email account or spoofing an email account in order to send messages requesting funds from someone within their organization, or from another business that this account already has a relationship with. 

Typically, they result in a request to either raise an invoice for fictitious services or products, or a request to change the bank account details which a legitimate invoice is going to be paid to. BEC attacks are so successful because they can look completely genuine, coming from an account that the person trusts .

What Kind of Attacks Take Place?

There are a number of different types of BEC attacks. One might be where a hacker takes control of the account of a high-ranking member of the organization. With this account they make a request to the accounts department for a payment, supposedly for products or services.

Another form of BEC involves the hacker taking over the account of a member of the finance department, locating an unpaid invoice and then sending a request over to that company explaining that the bank account details for the business have changed. This type of attack can be extremely difficult to recognise, and may not be noticed by either company for a very long time. 

Increased Staff Training 

It cannot be forgotten that staff are a vital part of good cybersecurity. If your team doesn’t have the knowledge to know how to deal with situations, investment in even the most powerful cybersecurity features won’t be effective. Staff can be a strong form of defense against BEC attacks – but they can also be a major weakness too. It all comes down to their level of understanding, and they can only get this through training sessions. 

According to cybersecurity specialists Redscan: “The one characteristic that all BEC attacks have in common is that they prey on human error. People are almost always a weak link in the security chain, and BEC scams are specifically crafted to take advantage of this.

Very few BEC attacks distribute malware or contain malicious links and for this reason, they often easily evade traditional security solutions. Email filtering, validation and multi-factor authentication are all essential, but these measures alone are insufficient.”

Therefore, it should be considered essential to provide staff with regular, high-quality training on the latest cyber threats and what to do about them. This shows the need to put strong staff training measures in place to minimize the issue of human error. When staff know what to look for from the perspective of defending against a BEC attack, they are more prepared.

Safeguarding Policies and Vulnerability scans

The fact that cybercrime is increasing should be a signal not only that this is an issue that needs to be taken seriously, but also that cyber defenses can be outdated extremely quickly. Therefore, it is important to implement strong policies and procedures so that you are not reliant on staff picking up on clues. For example, you could put in place a policy that states that any email requests to change bank account details must be verified with a phone call or face-to-face meeting before they can be approved. 

A vulnerability scan is a software-led cybersecurity measure that businesses should utilize on a regular basis. These scans should be used throughout your business’ network where they will look for any known weaknesses that could be exploited by cybercriminals. These scans can be a fairly blunt instrument, but they are fantastic in picking up on threats that can be easily dealt with. 

These should be carried out by cybersecurity professionals on a regular basis. While you might think that they can be run once and any issue can be then effectively dealt with, the truth is that many aspects of a business system change all the time. New applications are added, updates can be made that have unforeseen issues and much more. Vulnerability scans help to minimize the risk that these issues can later be exploited.

Work with Professionals

It is the case that every business is different – and that means that cybersecurity needs and requirements can vary widely. The policies, software and training that are right for one business, might be completely useless to another in a different industry. It can be a great idea, then, to work with cybersecurity professionals who can provide you with advice and insights. 

Many small and medium sized businesses do not have highly trained cybersecurity professionals on their staff – this can lead them to not necessarily understand the specific dangers and challenges. Working with professionals can provide your business with the kind of information you need. 

BEC attacks can be devastating for a business financially, so organizations need to make the investment in the right cybersecurity measures to keep them secure. Suffering a BEC attack can end up being far more costly than it would have been to put appropriate measures in place.