{
  "timestamp": "2025-02-05T23:32:55.686661",
  "model": "deepseek/deepseek-r1-distill-llama-70b",
  "request": {
    "messages": [
      {
        "role": "system",
        "content": "You are a security advisor providing end-user guidance on data security and protection.\n            Focus on practical, easy-to-follow security recommendations."
      },
      {
        "role": "user",
        "content": "\n            Provide clear security guidance based on:\n            \n            Content to reference:\n            Search Free Trial Get Demo Analyzing message metadata to protect against BEC attacks November 17, 2022 Can analyzing message metadata help to protect organizations from becoming the victim of a successful BEC attack? Business Email Compromise BEC is an umbrella term spanning many forms of social engineering email attacks that typically share the common characteristic that there is no obvious payload, i.e., suspicious URL or malware-infected attachment. Instead, they rely on the techniques of trickery and impersonation to succeed. BEC attacks can be carefully crafted to evade traditional security defenses including Secure Email Gateways SEGs and Microsoft Office 365s native security controls. While they generally represent a relatively small percentage of the phishing problem by volume, they can represent a relatively large percentage by cost in terms of damage done. This year the Federal Bureau of Investigation FBI concluded that the global cost to business of BEC attacks over the last 5 years or so was an eye-watering 43 billion dollars. Stop BEC attacks in the inbox In our last blog, we looked at how a modern email security solution can help to combat BEC attacks by working in the inbox and using a combination of advanced analytics, Artificial Intelligence AIMachine Learning ML, and Natural Language Processing NLP techniques. Why in the inbox? Because vigilance in the inbox is the most effective way to combat evasive threats like BEC attacks that have evaded detection at the boundary andor by Microsoft security controls. In this session, we will zoom in on one of those techniques and look at some of the quickest and simplest mechanisms for identifying the possibility of a BEC attack. Indicators and anomalies in message metadata. Check metadata for indicators of a BEC attack Domain-based Message Authentication, Reporting, and Conformance DMARC helps to protect email senders and recipients from spam, spoofing, and phishing. Working in the inbox, an effective email security solution will use the results of DMARC policy checks performed by Microsoft Office 365 and contained in the message header. These can contain potential indicators that might suggest that the message is malicious. Another important check is for mismatches in the message metadata. Messages where the display name on the message appears to be internal and FROM address is external, or where the FROM address is internal and the REPLY-TO address is external, provide good indicators that all is not well. Crowd-sourced threat intelligence Overall, the solution should also take advantage of crowd-sourced threat intelligence feeds to identify IP addresses andor hostnames in message headers that might indicate a BEC attack. For example, Cyrens GlobalView is a world-leading threat intelligence service protecting 1 billion users across 195 countries with 575,000 collection points POPS around the globe. Leveraging up-to-the-minute intelligence from feeds such as GlobalView and other threat intelligence feeds is essential to the process of identifying indicators of an attack. Stop BEC attacks Good detection techniques are the backbone of an effective defense against BEC attacks but on their own, theyre not enough. Usually, an attack involves several key people in the organization receiving identical or similar messages over a short period of time. An effective modern email security solution, working in the inbox needs to be able to identify all the malicious messages with this shared DNA and remediate them all automatically, in a single action, to ensure good inbox hygiene is maintained. However, detection lies at the heart of combating BEC attacks and while the mechanisms employed by defenses are normally hidden under the hood, understanding the processes at work gives an insight into how an effective email security technology helps protect customers. In the next blog in this series, well look at another aspect of effective BEC detection. Using Natural Language Processing techniques NLP to parse message content for key indicators. About Cyren Inbox Security Cyren Inbox Security CIS is a modern Integrated Cloud Email Security SaaS solution that augments native Microsoft and traditional secure email gateway defenses. CIS utilizes AIMLNLP capabilities with behavioral analytics, and up-to-the-minute cyber threat intelligence, to automatically protect against, and manage the remediation of email threats that have successfully evaded all other defenses to reach the users M365 inbox. Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Using AI to protect against BEC attacks Abusing Remote Administration Tools Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443\n            \n            Your guidance should include:\n            1. Easy-to-follow security best practices\n            2. Data protection recommendations\n            3. Safe usage guidelines\n            4. Common security risks and prevention\n            5. Privacy protection measures\n            6. When to seek additional security support\n            "
      }
    ],
    "model": "deepseek/deepseek-r1-distill-llama-70b"
  },
  "response": {
    "content": "**Step-by-Step Guide to Protecting Against Business Email Compromise (BEC) Attacks**\n\n1. **Understand BEC Attacks**: Recognize that BEC attacks are sophisticated social engineering tactics where attackers impersonate high-level executives to trick employees into transferring funds or data. They often lack malicious links or attachments, making them hard to detect.\n\n2. **Metadata Analysis**: \n   - **DMARC, SPF, DKIM**: Familiarize yourself with these authentication protocols. A failed DMARC check indicates potential spoofing.\n   - **Display Name Mismatch**: Be cautious if the sender's name doesn't match their email domain.\n   - **Reply-To Address Check**: Question emails where the \"From\" address is internal but the \"Reply-To\" is external.\n\n3. **Threat Intelligence Feeds**: Use tools like Cyren's GlobalView to identify malicious IPs or domains in email headers, enhancing detection of BEC attempts.\n\n4. **Language Analysis**: Use NLP to detect urgent or sensitive requests. Watch for sudden changes in language or tone from known senders.\n\n5. **Behavioral Analytics**: Monitor for unusual patterns, such as multiple similar emails to an employee or simultaneous contact from the same sender.\n\n**Actionable Security Best Practices:**\n\n- **Educate Employees**: Regular training and simulated phishing tests to help employees recognize BEC signs, such as odd language or urgent requests.\n  \n- **Advanced Email Security**: Implement solutions using AI and ML that work within the inbox to catch what traditional tools miss.\n\n- **Verify Requests**: Always confirm sensitive requests in person or via a known phone number, not through email.\n\n- **Protect Privacy**: Keep sensitive information confidential and avoid oversharing on social media to prevent attackers from gathering intelligence.\n\n- **Regular Audits and Monitoring**: Track failed DMARC reports and watch for spikes in similar emails to detect campaigns early.\n\n- **Immediate Reporting**: Employees should report suspicious emails to IT for analysis to prevent potential breaches.\n\n**Technology and Privacy Measures:**\n\n- **Layered Security**: Use a combination of email authentication protocols and advanced security solutions.\n  \n- **Encrypted Communication**: Use secure channels for sensitive data and have methods to confirm identities.\n\n- **Risk Assessment**: Continuously assess threats and update security measures to stay ahead of attackers.\n\nBy following these steps, individuals and organizations can significantly reduce the risk of falling victim to BEC attacks.",
    "usage": {
      "prompt_tokens": 987,
      "completion_tokens": 1587,
      "total_tokens": 2574
    },
    "model": "deepseek/deepseek-r1-distill-llama-70b"
  }
}