Hackers, never at a loss for creative deception, have engineered new tactics for exploiting the weakest links in the cybersecurity chain: ourselves! Social engineering and business email compromise (BEC) are two related cyberattack vectors that rely on human error to bypass the technology defenses businesses deploy to deter malware.<\/p>\n\n\n\n
Social Engineering is when hackers impersonate trusted associates or acquaintances to manipulate people into giving up their passwords, banking information, date of birth or anything else that could be used for identity theft. As it turns out, it\u2019s easier to hack our trust than our computers. Social engineering covers a range of tactics:<\/p>\n\n\n\n
Business email compromise is a targeted attack against corporate personnel, usually someone with the authority to request or fulfill a financial transaction. Victims execute seemingly routine wire transfers to criminals impersonating legitimate business associates or vendors.<\/p>\n\n\n\n
This form of fraud relies on a contrived pretext to request a payment or purchase be made on the attacker\u2019s behalf. According to the FBI, BEC attacks resulted in more than $26 billion (you read that right) between June 2016 and July 2019. Here are a few tips for protecting users and businesses from BEC attacks:<\/p>\n\n\n\n
Slow down<\/em> \u2013 BEC attacks combine context and familiarity (an email from your boss) with a sense of urgency (I need this done now!). This causes victims to lose their critical thinking capabilities.<\/p>\n\n\n\n Don\u2019t trust, verify<\/em> \u2013 Never use the same channel, in this case email, to verify the identity of the requester. Pick up the phone and call, or use video chat.<\/p>\n\n\n\n Prepare for the inevitable<\/em> \u2013 Use all the technology at your disposal to ensure a BEC attack doesn\u2019t succeed. Machine learning-enabled endpoint security solutions can help identify malicious sites.<\/p>\n\n\n\n Address the weakest link<\/em> \u2013 Train users to spot BEC attacks. Webroot testing shows that phishing simulations can improve users\u2019 abilities to spot attacks.<\/p>\n\n\n\n Webroot Security Intelligence Director, Grayson Milbourne, offers several suggestions that companies can do to increase their security posture. First, he says, \u201cWhenever money is going to be sent somewhere, you should have a two-factor verification process to ensure you’re sending the money to the right person and the right accounts.\u201d<\/p>\n\n\n\n Milbourne is also a big advocate of security awareness training. \u201cYou can really understand the security topology of your business with respect to your users\u2019 risk factors,\u201d he says. \u201cSo, the engineering team might score one way and the IT department might score another way. This gives you better visibility into which groups within your company are more susceptible to clicking on links in emails that they shouldn’t be clicking.\u201d<\/p>\n\n\n\n With the increase in scams related to the global COVID-19 pandemic, timely and relevant user education is especially critical. \u201cCOVID obviously has been a hot topic so far this year, and in the last quarter we added close to 20 new templates from different COVID-related scams we see out in the wild,\u201d Milbourne says.<\/p>\n\n\n\n \u201cWhen we look at first-time deployment of security awareness training, north of 40% of people are clicking on links,\u201d Milbourne says. \u201cThen, after going through security awareness training a couple of times, we see that number dip below 10%.\u201d<\/p>\n\n\n\nPerfecting Your Posture<\/h2>\n\n\n\n