Navigating the (Not So) Subtle Threat of Business Email Compromise

The 2024 Verizon Data Breach Investigations Report (DBIR) is out. As always, it contains a treasure trove of valuable information and crucial insights to help organizations understand trends in the threat landscape and take steps to defend more effectively against cyber threats.

Business Email Compromise (BEC) remains a significant and costly challenge for organizations globally. As detailed in the Verizon DBIR, BEC attacks do not necessitate advanced tactics to be successful, highlighting a disturbing ease in their execution and a high rate of effectiveness.

The Rising Cost of Complacency

BEC attacks have been consistently lucrative for cybercriminals. The DBIR points out that incidents involving pretexting, often leading to BEC, account for about one-fourth of financially motivated attacks over the past two years. These attacks typically involve manipulating individuals into making large financial transactions under false pretenses, with the median transaction amount hovering around $50,000, as indicated by the FBI’s Internet Crime Complaint Center (IC3) dataset.

Simplicity and Deception: A Potent Mix

One of the more alarming revelations from the DBIR is the simplicity and effectiveness of these schemes. “Phishing or Pretexting attacks don’t need to be more sophisticated to be successful against their targets, as we have seen with the growth of BEC-like attacks,” the report states. This observation underscores a critical vulnerability in organizational processes and human psychology that these attackers exploit — trust and routine.

Pretexting Over Phishing

Interestingly, the DBIR notes a significant shift in the tactics used by cybercriminals, with pretexting now overtaking phishing as the more common form of social engineering. This shift indicates a move towards more targeted and potentially more deceptive methods where attackers insert themselves into existing email conversations to manipulate outcomes subtly. “If you have been tracking our chronicle of the rise of BEC attacks, you know this is a viable and scalable way to address threat actor monetization anxieties,” explains the report.

The Stagnation of Threat Levels

Despite the high costs associated with BEC, there hasn’t been a dramatic increase in these incidents over the last year. They have, however, maintained their position as the top type of social engineering incident, which continues to cause substantial financial damages to organizations. The report remarks, “Unfortunately, the bad news comes next, which is that BECs continue to have a substantial financial impact on organizations… with the median transaction hovering around $50,000.”

A Momentary Reprieve in Fraudulent Transactions

On a somewhat positive note, the DBIR highlights a decrease in fraudulent transactions, a common endgame for BEC attacks, from a spike last year to more controlled levels this year. This reduction may indicate better detection and prevention strategies being adopted by organizations or possibly a shift in tactics by cybercriminals to other forms of cyber threats.

Reinforcing Defenses Against Business Email Compromise

The persistent challenge of BEC attacks is a stark reminder of the vulnerabilities inherent in our digital communications. An alarming statistic highlights that approximately 80% of organizations are susceptible to having their email security bypassed by attackers, emphasizing the critical need for more robust defenses beyond traditional methods. These statistics suggest that despite efforts to fortify email systems, many organizations remain vulnerable to sophisticated BEC schemes which often bypass conventional security measures by exploiting human factors and established trust.

In response to this significant threat, it is crucial for organizations to rethink their approach to email security. Relying solely on tools designed to detect fraudulent emails or placing the burden on users to identify and avoid spoofed emails is no longer sufficient. Instead, a more comprehensive approach that encompasses the principles of zero trust and zero guessing is necessary.

Out-of-band monitoring provides an additional layer of security by verifying significant transactions and sensitive actions through channels other than the primary communication channel. This method significantly reduces the risk of attackers succeeding in their deceptive practices, as the verification process is isolated from the potentially compromised network.

Non-repudiation adds another layer of security by ensuring that every action and transaction can be unequivocally traced to a verified identity, thus making it easier to identify and verify legitimate email messages and preventing malicious actors from denying their activities. This is crucial in maintaining accountability and traceability, especially in scenarios where security breaches may involve sophisticated impersonation techniques.

By adopting these advanced security measures, organizations can address the underlying vulnerabilities that enable BEC attacks. Fostering a culture of continuous verification and employing advanced security strategies like out-of-band monitoring and non-repudiation empowers businesses to protect themselves more effectively against the sophisticated and evolving nature of business email compromise threats.