Business Email Compromise: Understanding the Risks and Defending Your Organization

Posted April 4, 2023

In today’s digital age, businesses are increasingly reliant on email for effective communication and collaboration. However, this dependency exposes organizations to the risk of Business Email Compromise (BEC), a sophisticated type of cybercrime that targets employees with access to sensitive company information or financial resources. According to data compiled by Secureworks Counter Threat Unit (CTU), BEC attacks doubled in volume during the course of 2022.

As the threat landscape evolves, it is crucial for both mid-level IT staff and C-suite executives to understand the risks associated with BEC and implement robust security measures to protect their organizations.

BEC is a form of cybercrime in which attackers impersonate senior executives or trusted third parties, such as vendors, to deceive employees into transferring funds or disclosing sensitive information. These attacks are meticulously planned and executed, leveraging social engineering and well-crafted messages that convincingly mimic legitimate communication. According to the FBI, BEC scams have cost businesses over $26 billion between June 2016 and July 2019.

The consequences of falling victim to a BEC attack can be severe and far-reaching, including:

Financial Losses: Unauthorized transfers and payments can result in substantial financial losses, which may not always be recoverable.
Reputational Damage: A successful BEC attack can damage an organization’s reputation, leading to a loss of customers and partners.
Legal and Regulatory Consequences: Organizations that fail to safeguard sensitive data may face legal and regulatory penalties, especially in industries with strict compliance requirements.
Operational Disruption: BEC attacks can disrupt business operations, potentially causing delays, loss of productivity, and increased costs.

To minimize the risk of BEC attacks, organizations should implement the following strategies:

Employee Training and Awareness: Educate employees on the risks of BEC and how to identify potential scams. Regular training sessions and simulated attacks can help build a security-conscious culture within the organization.
Multi-Factor Authentication (MFA): Implement MFA for email accounts and other sensitive systems, adding an extra layer of security that makes it more difficult for attackers to gain unauthorized access.
Email Security Measures: Strengthen email security by employing technologies like Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting & Conformance (DMARC). These measures help prevent email spoofing and authenticate the sender’s identity.
Monitor and Limit Access: Regularly review employee access to sensitive data and systems, ensuring that access is granted on a need-to-know basis. Implement the principle of least privilege to reduce the potential attack surface.
Incident Response Plan: Develop a comprehensive incident response plan that includes procedures for handling BEC attacks. This plan should outline steps for identifying, containing, and recovering from an attack, as well as the roles and responsibilities of all stakeholders.
Vendor Risk Management: Assess and monitor the security practices of third-party vendors and partners to ensure that they are not introducing additional risks to your organization. Establish clear communication protocols to prevent BEC attackers from exploiting vendor relationships.
Verification Procedures: Establish a standard procedure for verifying requests involving sensitive information or financial transactions. This could include requiring verbal confirmation or implementing a dual-approval process.
Regular Backups: Maintain regular backups of critical data to facilitate recovery in the event of a successful BEC attack. Store backups securely and test them periodically to ensure they can be restored when needed.
Stay Informed: Keep up to date with the latest trends and threats in the cybersecurity landscape. This knowledge can help your organization stay ahead of emerging tactics used by BEC attackers.
Foster a Culture of Open Communication: Encourage employees to report any suspicious activity or requests without fear of retribution. This can help create an environment where potential BEC attacks can be identified and addressed promptly.

Business Email Compromise is a growing threat that poses significant risks to organizations of all sizes. By understanding the risks associated with BEC and implementing a multi-layered defense strategy, both mid-level IT staff and C-suite executives can work together to safeguard their organization’s assets, reputation, and long-term success. While no single solution can guarantee complete protection against BEC attacks, a combination of employee training, robust security measures, and proactive risk management can significantly reduce the likelihood of falling victim to this increasingly prevalent form of cybercrime.

Kyle Vinar

Kyle Vinar is Partner / President of Verus Corporation. He oversees all business operations and coaches Verus teams to continually improve on their solutions from client experience to product development and overall solution implementation. He works with all Verus resources to increase efficiencies and excellence in every aspect of their organizational roles. Kyle believes that people are the last real competitive edge that a company can have and constructing a rich culture is a vital step in running a world-class organization. Therefore he strives to create a culture within Verus that allows everyone to show up authentically and grow both personally and professionally, which in turn allows Verus Corp team members to provide clients with top-of-the-line service. Kyle helps balance strategy, capacity, and culture in such a way that has allowed Verus Corp to achieve exponential growth since he joined the company in 2013. One of Kyle’s greatest professional achievements has been in helping lay the foundation upon which Verus Corporation could be named the 2nd Best Place to Work by the Minneapolis/St. Paul Business Journal. Kyle holds a Bachelor of Science in Marketing from St. Cloud State University. He lives in Champlin with his wife and 3 children. He has enjoyed volunteering as a soccer coach for over 6 years and was the former Director of Coaching for Rebels Soccer Club. If Kyle isn’t on the sidelines of one of his children’s soccer games or in the audience of his eldest’s musicals, he can often be found cruising scenic routes on his Harley, in a deer stand, or on the golf course.