{
  "timestamp": "2025-02-05T23:30:56.475217",
  "model": "deepseek/deepseek-r1-distill-llama-70b",
  "request": {
    "messages": [
      {
        "role": "system",
        "content": "You are a security advisor providing end-user guidance on data security and protection.\n            Focus on practical, easy-to-follow security recommendations."
      },
      {
        "role": "user",
        "content": "\n            Provide clear security guidance based on:\n            \n            Content to reference:\n            Search Free Trial Get Demo Using AI to protect against BEC attacks November 3, 2022 With no payload to detect, how best can organizations protect themselves from Business Email Compromise and other social engineering attacks? by John Stevenson Sometimes the simplest frauds are the most successful. Some years ago, local authorities in the UK were targeted by a series of just such frauds. The modus operandi of the criminals was to masquerade as legitimate suppliers of building maintenance services and contact local authority finance departments, requesting their regular payments be made to new bank accounts. The tools of the trade? Letterheads and faxes. Roll the clock forward. Now, cybercriminals are using similarly simple techniques to conduct social engineering attacks against organizations with equally successful results as the latest report from Osterman  Phishing, BEC and Ransomware Threats for Microsoft 365 Users  clearly shows. Social engineering From Business Email Compromise BEC and Email Account Compromise EAC to Account Takeover ATO attacks, experts calculate as much as 91 of all cyberattacks start with a social engineering emails Deloitte 2020. Despite best efforts, these attacks keep on getting past traditional email security defenses and into users inboxes. Managing the problem is time-consuming, costly and a waste of valuable technical expertise. So how do you stop these attacks? Protect the Inbox For over 25 years the cybersecurity industry has focused on trying to protect email users by defending the network perimeter with a Secure Email Gateway SEG but evasive social engineering attacks have always found their way past these defenses. For more information on the short-comings of perimeter email security, read our threat intelligence report,  Beyond the Email Perimeter  Now Microsoft Office 365 email is used by the majority of organizations and though the security it offers is excellent, social engineering attacks continue to evade the native security controls and arrive in the inbox. To prevent these attacks from being successful, organizations need to employ an Integrated Cloud Email Security ICES solution that works in the inbox itself, automatically detecting and remediating attacks. Stop BEC, EAC, ATO, and attacks with no payload Often, social engineering attacks have a payload  for example a phishing URL or a malware-infected attachment such as one containing ransomware. The latter tend to make the headlines when they succeed, but these attacks can be automatically detected and remediated in the inbox by the ICES if it is powered by real-time analysis and the very latest threat intelligence. But what if the attack has been carefully crafted so it doesnt contain a payload? Business Email Compromise BEC, Email Account Compromise EAC and other social engineering email attacks dont have an obvious payload. Instead, they rely on techniques of trickery and impersonation to succeed. To combat them, look for an ICES that employs the very latest Artificial Intelligence AI techniques like Machine Learning ML and Natural Language Processing NLP detect and neutralize the attacks. An ICES which uses these techniques to analyze each message as it arrives in the inbox will stop this type of social engineering attack. Cyren uses AI to stop evasive attacks Cyren Inbox Security is an ICES that protects organizations from social engineering attacks like BEC, EAC, ATO, and imposter fraud, by working inside the inbox to find and automatically remediate messages irrespective of whether they have an obvious payload. It does this using a combination of machine learning, natural language processing, and heuristics to combat the threat. In my next blog, well look at how Cyren Inbox Security uses these techniques to examine the forensic evidence in social engineering attacks and automatically remediates them from the inbox. Try it for Free Instant Data Classification Cyren URL Category Chacker Prev What is Microsoft Office 365 Advanced Threat Protection? Analyzing message metadata to protect against BEC attacks Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443\n            \n            Your guidance should include:\n            1. Easy-to-follow security best practices\n            2. Data protection recommendations\n            3. Safe usage guidelines\n            4. Common security risks and prevention\n            5. Privacy protection measures\n            6. When to seek additional security support\n            "
      }
    ],
    "model": "deepseek/deepseek-r1-distill-llama-70b"
  },
  "response": {
    "content": "### Security Guidance to Protect Against BEC and Social Engineering Attacks\n\nGiven the evolving nature of cyber threats, especially Business Email Compromise (BEC) and other social engineering attacks, it\u2019s crucial to adopt a multi-layered approach to security. Below are practical, easy-to-follow recommendations to help protect your organization and data:\n\n---\n\n### **1. Security Best Practices**\n- **Verify Sender Identity**: Always question unusual emails, especially those asking for sensitive information or financial transactions. Pick up the phone to verify the request with the sender using a known, trusted contact method.\n- **Use Multi-Factor Authentication (MFA)**: Enable MFA for all email and cloud service accounts to add an extra layer of security.\n- **Be Cautious with Links and Attachments**: Avoid clicking on suspicious links or downloading attachments from untrusted sources. Hover over links to check their destination before clicking.\n- **ImplementStrict Payment Processes**: Require multiple approvals for wire transfers or changes to vendor payment details. Ensure that any payment changes are confirmed through a separate communication channel.\n- **Regularly Update Software**: Keep email clients, browsers, and security tools up to date to protect against vulnerabilities.\n\n---\n\n### **2. Data Protection Recommendations**\n- **Backup Critical Data**: Regularly back up sensitive data to a secure, off-site location to protect against data loss in case of an attack.\n- **Classify Sensitive Information**: Use data classification tools to identify and protect sensitive data, such as financial records or personal information.\n- **Encrypt Sensitive Emails**: Use encryption for emails containing confidential information, such as payment details or personal data.\n- **Limit Access to Sensitive Data**: Restrict access to sensitive information to only those who need it for their work.\n\n---\n\n### **3. Safe Usage Guidelines**\n- **Avoid Using Public Wi-Fi for Sensitive Tasks**: Public Wi-Fi networks are often unsecured and can expose your data to interception. Avoid accessing sensitive accounts or conducting financial transactions over public Wi-Fi.\n- **Educate Employees**: Provide regular training on recognizing and reporting phishing, BEC, and other social engineering attacks.\n- **Monitor Email Accounts**: Encourage employees to monitor their email accounts for unusual activity and report any suspicious emails to IT or security teams immediately.\n\n---\n\n### **4. Common Security Risks and Prevention**\n- **Phishing and BEC Attacks**: These attacks often impersonate trusted individuals or organizations to trick users into revealing sensitive information or transferring money. Prevention includes email filtering tools, employee training, and strict verification processes.\n- **Email Account Compromise (EAC)**: Attackers gain access to email accounts to steal information or launch further attacks. Prevention includes strong passwords, MFA, and monitoring for unusual account activity.\n- **Imcerer Fraud**: Attackers impersonate executives or vendors to request urgent payments. Prevention includes verification protocols and education on identifying suspicious requests.\n\n---\n\n### **5. Privacy Protection Measures**\n- **Use Privacy Tools**: Enable privacy features in email clients, such as blocking external images or tracking pixels, to reduce the risk of email-based surveillance.\n- ** Avoid Posting Sensitive Information Online**: Refrain from sharing sensitive business or personal information on public platforms.\n- **Secure Devices**: Protect laptops, phones, and tablets with strong passwords, encryption, and remote wipe capabilities in case of theft or loss.\n\n---\n\n### **6. When to Seek Additional Security Support**\n- If your organization lacks the expertise or resources to implement advanced security measures, consider hiring a cybersecurity consultant or outsourcing to a Managed Security Service Provider (MSSP).\n- If you suspect or experience a security incident, contact your IT team or a cybersecurity professional immediately to investigate and contain the threat.\n- Regularly review your security posture and conduct risk assessments to identify vulnerabilities and improve defenses.\n\n---\n\nBy combining advanced AI-powered tools like Integrated Cloud Email Security (ICES), employee training, and strict security protocols, organizations can significantly reduce the risk of falling victim to BEC and other social engineering attacks. Stay vigilant and proactive in protecting your inbox and sensitive data.",
    "usage": {
      "prompt_tokens": 899,
      "completion_tokens": 1321,
      "total_tokens": 2220
    },
    "model": "deepseek/deepseek-r1-distill-llama-70b"
  }
}