Business email compromise attacks are designed to bypass traditional email security measures, such as spam filters.

Last year, the FBI reported that incidents of business email compromise (BEC), also known as spear phishing, CEO fraud, and invoice fraud, had been reported in all 50 states and 150 countries, with global losses exceeding $12 billion. BEC scams are continuing to explode in popularity among cyber criminals, with attacks increasing by 476% between Q4 2017 and Q4 2018, according to research from Proofpoint. Recently, a Lithuanian national pled guilty in U.S. court to his role in a BEC scheme that bilked Facebook and Alphabet out of more than $100 million.

What Is Business Email Compromise?

As opposed to traditional phishing scams, where identical messages are mass-emailed to thousands of recipients, BEC scams involve sending customized emails that target specific employees within a company, usually those who handle wire transfer payments or have access to sensitive information, such as employee payroll data. Before launching an attack, hackers research their targets in great detail, culling information from public sources such as social media networks and official company web properties.

After selecting a victim, hackers send the employee an email impersonating a company executive or business partner. Sometimes, the sender’s email address is spoofed; other times, hackers have obtained the real user’s login credentials and taken over their email account. The BEC email will contain an urgent request for a wire transfer, allegedly to pay a past-due invoice, or sensitive information, such as employee tax withholding forms. In one scheme the IRS issued an official warning about last year, the BEC emails requested both a wire transfer and employee tax data.

The BEC email warns of dire consequences should the recipient not act immediately, such as a delay on a time-sensitive parts shipment or the next round of employee paychecks. BEC emails are designed to look as realistic as possible, and sometimes, hackers will follow up with a phone call to add legitimacy and increase the victim’s sense of urgency. Thinking they’re doing the right thing, the recipient sends the money or data.

Sometimes, victims of BEC don’t realize they’ve been scammed until much later, such as when an impersonated vendor contacts the company about non-payment on a real invoice.

Preventing Business Email Compromise

Because business compromise emails do not contain malicious links or attachments, they usually bypass traditional email security measures, such as spam filters. However, there are technical solutions and non-technical controls companies can implement to help stem the tide, such as:

• Implement multi-factor authentication (MFA) to protect against account takeovers.
• Use the DMARC email security protocol to protect against domain spoofing.
• Prohibit employees from using personal emails for company business and vice versa.
• Talk to a cybersecurity professional about technical solutions that can identify compromised accounts, as well as solutions that block emails that contain sensitive data from being sent.
• Avoid using a private email server. Most companies don’t have the in-house resources to secure and monitor one.
• Ensure that all employees have appropriate and continuous cybersecurity training, including how to spot BEC scams.
• Require that all sensitive operational procedures, such as making wire transfers or releasing employee payroll data, be authorized by more than one person.

The cyber security experts at Lazarus Alliance have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting organizations of all sizes from security breaches. Our full-service risk assessment services and Continuum GRC RegTech software will help protect your organization from data breaches, ransomware attacks, and other cyber threats.

Lazarus Alliance is proactive cyber security®. Call 1-888-896-7580 to discuss your organization’s cyber security needs and find out how we can help your organization adhere to cyber security regulations, maintain compliance, and secure your systems.

New HHS publication outlines top cyber threats & best practices for healthcare industry

Noting that cyber security is “the responsibility of every health care professional, from data entry specialists to physicians to board members,” the U.S. Department of Health and Human Services (HHS) has published Health Industry Cybersecurity Practices: Managing Threats and Protecting Patients (HICP). The four-volume publication, which was mandated by the Cybersecurity Act of 2015, is aimed at hospital executives and cyber security professionals in healthcare organizations of all sizes and leverages the NIST Cybersecurity Framework.

HHS: Email phishing & ransomware among top cyber threats to healthcare organizations

The HHS guide focuses on what the agency considers to be the current top cyber security threats to the healthcare industry: email phishing; ransomware; loss or theft of hardware; insider, accidental, or intentional data loss; and attacks against smart medical devices that put patient safety at risk. The publication’s two Technical Volumes outline 10 best practice areas to mitigate cyber security threats:

• Email protection systems
• Endpoint protection systems
• Access management
• Data protection and loss prevention
• Asset management
• Network management
• Vulnerability management
• Incident response
• Medical device security
• Cybersecurity policies

Rather than introducing a new framework, HHS instead maps its best practice and sub practice recommendations to those in the NIST CSF. Recognizing the fundamental differences and concerns that organizations of different sizes encounter, separate recommendations are given for small, medium, and large organizations.

The financial impact of healthcare breaches can be devastating, especially to small organizations. The HHS points out that the healthcare industry has the highest data breach cost of any industry, at an average of $408 per record and $2.2 million per organization. In 2016, the healthcare industry as a whole lost $6.2 billion to data breaches.

HHS urges proactive healthcare cyber security, comparing cyber hygiene to hand-washing

Healthcare cyber security has been a vexing issue for quite some time, and many issues stem from a lack of employee cyber security training. Unlike many industries, which made the switch from paper and typewriters to digital files and computers over a period of years, the healthcare industry digitized practically overnight. Employee training on cyber security best practices is notoriously spotty; healthcare organizations tend to focus on HIPAA compliance, with cyber security awareness an afterthought at best. The HHS notes that healthcare facilities often “deploy technologies without cybersecurity safeguards or use them (intentionally or unintentionally) without proper protections” and points out that four out of five U.S. physicians have experienced some form of cyber attack.

Employee buy-in presents another problem. Many front-line healthcare workers feel that their only job is to care for patients and that cyber security is the IT department’s problem. The HHS publication points out that in modern healthcare, cyber security is a function of patient care. Cyber attacks on electronic health records systems and smart medical devices don’t just disrupt business operations; they put patients’ health and even lives at risk. As such, the HHS states, healthcare workers must be taught to see cyber security hygiene the way they are taught to see hand hygiene; just as they wash their hands to prevent the spread of infections, they need to practice cyber hygiene to protect electronic patient records, IoT devices, and other healthcare systems from malware infections and other cyber attacks.

The cyber security experts at Lazarus Alliance have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting organizations of all sizes from security breaches. Our full-service risk assessment services and Continuum GRC RegTech software will help protect your organization from data breaches, ransomware attacks, and other cyber threats.

Lazarus Alliance is proactive cyber security®. Call 1-888-896-7580 to discuss your organization’s cyber security needs and find out how we can help your organization adhere to cyber security regulations, maintain compliance, and secure your systems.