A new report from Secureworks has found that business email compromise (BEC) remains “one of the most financially damaging online crimes overall for orgs” in 2023. The security firm’s 2023 State of the Threat report says BEC “exceeds even ransomware in aggregate, mainly because it is so prolific, even if individual financial losses from BEC may be lower than individual losses from ransomware.”
The researchers explain, “Threat actors use a range of techniques including mass phishing campaigns to steal credentials which are then used to access the victim email account. Once they have access, they often monitor the activity of the email account, identifying email chains with vendors and suppliers in which they can insert themselves.
After the attacker has successfully initiated communication with the victim, they provide modified legitimate financial documents or payment instructions for the victim to send money to the attacker-controlled accounts. Attackers may also spoof victim organizations to request payment without first compromising a victim's email account.”
Teaching employees to follow security best practices, including using multifactor authentication (MFA), can help prevent targeted social engineering attacks.
“Organizations can mitigate BEC attacks by comprehensively implementing MFA across all user accounts, including those for senior executives,” Secureworks says. “But remember that not all MFA solutions are created equal; using an authenticator app is better than SMS, and number matching is an improvement on click-to-accept, and represents a meaningful mitigation to MFA fatigue.
It is advisable to closely follow Microsoft's Outlook authentication guidance to continually adopt best practices. Training employees not to accept MFA requests they did not generate is also a useful exercise. Robust business processes such as two-person payment processing, telephone-only approvals, and telephone-only vendor checks are essential.”
KnowBe4 enables your workforce to make smarter security decisions every day. Over 65,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.
Secureworks has the story: https://www.secureworks.com/resources/rp-state-of-the-threat-2023
