A new survey by Trend Micro reveals that 43% of organizations in twelve countries have been affected by Business Process Compromise (BPC) attacks. In spite of this, 50% of management teams don’t even know what these attacks are. Security teams showed more awareness of the threat, with 72% saying that preventing BPC attacks was a top priority.
A BPC attack discreetly alters legitimate business processes to generate profit for the attackers.
A key component of these attacks is stealth, with attackers remaining within a network for extended periods of time. This allows the attackers to become very well-versed in the internal workings of the organization. That familiarity allows the attackers to carry out the essence of the attack, which can include diverting money from the organization’s cash flow system, smuggling illegal products using the organization’s infrastructure, or even rigging the stock market to accumulate millions of dollars.
“We’re seeing more cybercriminals playing the long game for greater reward,” said Rik Ferguson, vice president of security research for Trend Micro. “In a BPC attack, they could be lurking in a company’s infrastructure for months or years, monitoring processes and building up a detailed picture of how it operates. From there they can insert themselves into critical processes, undetected and without human interaction. For example, they might re-route valuable goods to a new address, or change printer settings to steal confidential information – as was the case in the well-known Bangladeshi Bank heist.”
In the Bangladeshi Bank heist, attackers used their knowledge of the SWIFT financial platform to steal up to $81 million via fraudulent transactions. New-school security awareness training can help employees recognize and prevent these attacks, both before and after they’ve taken root. By teaching employees to be on the lookout for potential weak points or exploitable processes, organizations can drastically reduce the success of attackers who try to infiltrate their networks.
Help Net Security has the story: https://www.helpnetsecurity.com/2018/12/07/business-process-compromise/
Find out how affordable new-school security awareness training is for your organization. Get a quote now.
