{
  "timestamp": "2025-02-05T21:46:08.586387",
  "content": "Search Free Trial Get Demo 2021 Phishing  BEC Attacks August 3, 2021 Ive been very busy this summer, which is why Im just now reading the 2021 Verizon Data Breach Investigations Report. Here are a few takeaways from the section about the Social Engineering attack pattern read phishing. Phishing is responsible for the vast majority of breaches in this pattern, with cloud-based email servers being a target of choice. I think we all saw this one coming. What I didnt expect was the emphasis on cloud email servers. Breaches as a result of successful Social Engineering phishing attacks are up from last year and have been up every year since 2017. The authors of the report arent sure why cloud email servicesservers are such a focus, but we have our own theories well outline in the next paragraph. Additionally, Social Engineering attacks often result in the loss of Credentials. This pattern saw those stolen credentials used in both Hacking and Malware attacks. And there it is. We believe cloud email servicesservers are a focus because it gives attackers the ability to launch follow-on attacks like Business Email Compromise and Ransomware. What better way to convince employees that the CFO needs gift cards than the use the CFOs actual email account? On the other hand, that Phishing email may have also been dropping Malware, which tends to be a Trojan or Backdoor of some type This statement aligns with the threat intelligence we gather by analyzing malicious email attachments. A lot of malicious email attachments are not directly ransomware. Often, the attacker wants to first trick the user into installing malware that allows them remote access to the network. Once the bad actors have remote access, they can come and go as they please and move around the corporate network looking for the most impactful systems to compromise. Pretexting, normally associated with the BEC also makes a strong showing. By strong showing, the authors of the Verizon DBIR report mean that BEC accounts for about 17 of the breaches caused by social engineering . By contrast, the breaches caused by traditional phishing are about 82. So, yes, BEC makes a strong showing but its still a distant second to phishing. To be fair, the frequency of BEC attacks is rising dramatically and the impact of them is far easier to measure than other forms of compromise. real phishing may be even more compelling than simulations. In a sample of 1,148 people who received real and simulated phishes, none of them clicked the simulated phish, but 2.5 clicked the real phishing email. This little gem jumped right off the page. I think user education is an important piece of defending an organization against phishing but far too many businesses use it as a compensating control for better detection using machine learning, etc. Users can absolutely help defend the enterprise but they should be the last few inches of defense, not the last mile. Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Axie Infinity Player Wallets Targeted by Poisoned Google Ads Content What is Business Email Compromise BEC? Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443",
  "analysis_type": "user_guidance",
  "analysis": "**Security Guidance: Protecting Against Phishing, BEC, and Related Threats**\n\nIn response to the rising threats of phishing and Business Email Compromise (BEC), here is a structured approach to enhance your security posture:\n\n### 1. Security Best Practices\n\n- **Educate Users**: Implement regular training on phishing and BEC recognition. While essential, this should complement, not replace, technological defenses.\n- **Enable MFA**: Mandate multi-factor authentication for all accounts, especially cloud services, to add an extra layer of security.\n- **Deploy Secure Email Gateways**: Use advanced solutions with machine learning to detect and block phishing attempts.\n- **Monitor Activity**: Regularly audit email accounts for suspicious activity and implement alerts for unusual behavior.\n- **Develop Incident Plans**: Establish clear response protocols for breaches to minimize impact.\n\n### 2. Data Protection Measures\n\n- **Protect Credentials**: Use password managers to generate and store unique, strong passwords for each account.\n- **Encrypt Sensitive Data**: Apply encryption to emails and files containing confidential information.\n- **Backup Regularly**: Ensure data backups are secure, tested, and stored separately from original data.\n- **Restrict Access**: Limit data access to only necessary personnel to reduce exposure risks.\n\n### 3. Safe Usage Guidelines\n\n- **Verify Senders**: Check email sender details closely to spot spoofing, especially for financial requests.\n- **Exercise Caution**: Avoid clicking links or opening attachments from unfamiliar sources. Hover over links to preview URLs.\n- **Secure Accounts**: Enable two-factor authentication for email and financial accounts.\n- **Report Suspicious Emails**: Establish a channel for reporting phishing attempts to IT/security teams for analysis.\n\n### 4. Managing Common Risks\n\n- **Phishing Prevention**: Use email gateways and educate users on identifying suspicious emails.\n- **BEC Mitigation**: Verify financial requests through separate communication channels and set up email spit-checking.\n- **Malware Defense**: Install anti-malware tools, keep systems updated, and avoid risky downloads.\n\n### 5. Privacy Protection\n\n- **Limit Data Sharing**: Only share personal data when necessary and verify recipient authenticity.\n- **Use Privacy Tools**: Utilize VPNs and secure browsers for public Wi-Fi use.\n- **Monitor Breaches**: Check for personal data exposure via breach alert services and act promptly if compromised.\n\n### 6. Seek Support When Needed\n\n- **Incident Response**: In case of a breach, avoid panic and contact security professionals.\n- **Expert Consultation**: If internal resources are insufficient, engage with security experts for tailored solutions.\n\nBy following these guidelines, you enhance your resilience against evolving cyber threats, ensuring a proactive and secure approach to data protection."
}