BEC and Account Takeovers on the Rise; Training and Education Should Supplement Technology

There are many ways companies protect their networks. Unfortunately, malware still finds its way in into environments more often than anyone would like to admit. Cybercriminals are becoming craftier in how that malware operates, hides, and gets inside in the first place. Even when tools for defense are in place, humans are still the weakest link and have a tendency to unwittingly invite malware onto the network that so many people work hard and spend untold money protecting. This is according to a recent study called “The Human Factor 2016” by Proofpoint.

The study, which included reviews of over one billion emails and 150 malware samples found that there are a few primary ways that human flaws come into play and ultimately result in a negative outcome; two of them being account takeovers and/or business email compromise (BEC).

Social engineering is at the heart of all network breaches, malware executions, account takeovers and BEC attacks. Tricking recipients into performing actions they may not otherwise do is the needed skill; and one doesn’t have to be an actor to pull it off. Cyber security expert Jim Stickley of Stickley on Security has been hired to break into numerous facilities just to show how simple it is without any acting training what-so-ever. And shockingly, he has succeeded more often than he has failed.

If a cybercriminal is successful, there could be numerous ramifications including, but certainly not limited to a malware-laden file being downloaded and executed from a clicked link in email or via social media. Login credentials to the corporate online financial accounts could be handed over before the victims know what happened. Additionally, and perhaps even more financially dangerous would be for someone with authorization to unwittingly wire a large sum of money to a cybercriminal who was impersonating a CEO or another senior executive. Of the participants in the Proofpoint study, 80% said their organizations experienced at least one BEC attack within the 30-day period prior to participating in the study.

While physical security compromises happen and can be harmful, phishing, which has various forms such as spear-phishing and whaling, is the primary way that malicious files end up on a corporate network; how financial accounts can become compromised; and how BEC succeeds. Phishing in any form is a high-volume method of attack and the primary goal of these is to go around any security technology tools that are in place.  Phishing is no longer limited to email. In fact, in a separate study by Proofpoint (Threat Summary Report) in Q2 of this year, social media phishing via LinkedIn, Facebook, and Twitter rose 150% over the first quarter of the year.

So regardless of the technology put into place, training employees and anyone with access to the corporate network is critical. Everyone should know how to identify phishing in all of its forms and be tested on it. In addition, strict procedures should be in place to ensure that any financial transactions have multiple approvals before they can take place. This is particularly true with large sums of money. The process should never be subverted and email requests should be thoroughly checked out before they are completed. If there is any doubt about who sent any email message, even if it’s to authorize a vendor to perform work on equipment in the office, it should be confirmed independently of replying to the email message. Voice communication is one of the best tools for lowering risk of being a victim of any of these crimes.

In addition to a significant increase in social media phishing, ransomware attachments also rose by 45% and up to 10 million Android devices were recently compromised by various forms of malware. The bottom line is that organizations, large and small, should increase training and education to supplement any technology tools put into place.