What Is Business Email Compromise (BEC)?
Business email compromise (BEC) is a dangerous and pervasive type of email spoofing that targets businesses, aiming to damage them in some financial or reputation-based way. It does so via deceptive tactics, such as CEO or executive impersonation, allowing BEC attacks to evade security filters, leading to fraud, compromised accounts, and data leakage.
Other types of tactics used by threat actors are account takeover and look-alike domains, which impersonate senior-level executives and business partners in BEC scams. Often overlooked by spam filters, it only takes one interaction with a BEC email to spark a crippling attack. But detecting and extracting spear phishing scams is more complex than fine-tuning email and anti-virus security. Social engineering threats pose a unique challenge for security teams because even sophisticated first-alert security systems will fail to stop threats they can’t detect.
Sources BEC Intel From Inception to Inbox
BEC emails are difficult to stop because of their simplicity and reliance on social engineering instead of technical exploitation. There are no malicious attachments, URLs, or other technical indicators that email filters commonly rely on to detect threats. Instead, BEC attacks manipulate and trick recipients into executing urgent financial transactions like sending confidential data over email or submitting credentials on a fake landing page, such as this O365 lure.
As a result, BEC emails frequently make it past filters and into user inboxes.
Quickly Identifies and Prioritizes BEC Threats
Without expert analysis, many BEC threats that rely solely on impersonation and social engineering can go undetected. The sheer volume of suspicious emails reported by users and new domains registered daily make it difficult for security teams to weed out false positives and focus on real threats.
Agari quickly identifies and prioritizes malicious emails through a proven combination of automated analysis and detailed human expertise. This approach eliminates false positives while ensuring real threats are quickly and efficiently identified, keeping enterprises one step ahead of BEC attacks without overloading their security teams.
Stops BEC Attacks with End-to-End Disruption
Stopping BEC attacks before employee compromise is difficult. Threat actors rely on a sense of urgency to convince victims to act immediately, pressuring security teams to quickly find and mitigate threats. Security teams are also blindsided by BEC attacks and forced to respond reactively, because they originate from hacked, legitimate accounts or are cloaked by look-alike domains created through commonly used registrars and hosted on legitimate servers.
How Can I Protect from BEC Attacks?
Fortra's new ICES platform for the lofty problem of maintaining cloud-based security – Cloud Email Protection – takes a different approach to defend against BEC threats. We use intelligence to disrupt BEC attacks from inception to delivery, while allowing enterprises to have complete visibility into the external threats targeting their business.
Cloud Email Protection does this by leveraging proactive monitoring that searches for malicious look-alike domains and crowdsourced BEC intelligence from millions of user inboxes. From inside the firewall, trained employees are at the ready to provide an additional layer of defense by reporting suspicious emails for analysis and response with Fortra's Suspicious Email Analysis service.
Extends Email Protection Beyond Frontline Security
Today, businesses must rely on a broad set of tools and services to protect against social engineering attacks. BEC email threats are designed by threat actors to evade email security and target multiple employees, but it only takes a single response to inflict significant damage to an enterprise.
