If you are still wondering what other new enterprise network security risk may exist, the answer is Business Email Compromise (BEC). If the recent developments from 2016 in cybersecurity are considered as indicators, it will be seen that the traditional theft of credentials is not the game name anymore; Cybercriminals now source new techniques to access the cold cash directly.
Business E-mail Compromise (BEC) is an advanced fraudulent technique that targets businesses that work with foreign suppliers and/or businesses that regularly perform wire transfer payments. It was formerly known as the “Man-in-the-E-mail Scam” but was recently renamed as “Business Email Compromise (BEC)” to focus on the “business angle” of this kind of scam and to avoid
…show more content…
The first thing hackers try to see is if they can penetrate your network by spoofing the email addresses of the frontline executives – CEO, Financial administrators, Director of Finance etc. The notable thing about BEC is that it involves the impersonation of a prominent business stakeholder to extract or extort funds and important information about a business. Often times, the victims believe they are carrying out a routine transaction or a business process.
How it Works
BEC criminals start by equipping themselves with relevant information about the inner working processes of the target company and valuable information about selected employees – usually business front liners. This information can be gotten through various sources using ‘Social Engineering’ techniques.
Target employee receives a well-crafted email that appears to come from the CEO or top administrative personnel requesting for a wire transfer; such emails may likely receive less scrutiny due to the how legitimate it looks also because they do not differ from the normal emails handled every day. The employee, convinced that the request is legitimate, unwittingly processes the transfer of the requested sum to the requesting criminal’s
…show more content…
confirmed legitimate.
3. Avoid the use of free web-based e-mail accounts e.g. Gmail, Yahoo mail etc. to establish a company e-mail account instead establish a company domain name.
4. Be careful with what is being posted on social media and company websites, especially about job duties/descriptions, hierarchal information, and out of office details.
5. Be suspicious of requests for secrecy or pressure to take action quickly.
6. Consider additional IT and financial security procedures, including the implementation of an ‘Out of Band Communication channel’ such as telephone calls, to verify significant transactions.
7. Delete Spam mails immediately and report such mails from unknown parties. DO NOT open spam e-mail, click on links in the e-mail, or open attachments. These often contain malware that will give subjects access to your computer system.
8. Forward vs. Reply: Do not use the “Reply” option to respond to any business e-mails. Instead, use the “Forward” option and either type in the correct e-mail address or select it from the e-mail address book to ensure the intended recipient’s correct e-mail address is
The news article that I decided to do my assignment on is about a bank manager, Debra Anne Chapin, that embezzled 2 million dollars from a bank. The news article’s title is, “Former manager jailed for cheating bank out of $2M; Woman used cash to pay bills, gamble and feed her cocaine habit.” The crime took place in Calgary between June 1, 2006 and June, 30 2008. This embezzlement is a classic case of white collar crime and demonstrates numerous criminological theories.
Email security services will include blocking ransomware and emerging threats with the highest effectiveness and accuracy, stopping new and sophisticated threats such as ransomware, spear phishing, and business email compromise. Spear phishing will be prevented by having a comprehensive defense that includes multiple layers of protection, strong isolation , deep visibility and dynamic security awareness. Attacks will be contained and responses will be orchestrated across endpoint security and web gateways by remediating attacks and blacklisting threats. Dynamically classify impostor email and other threats that don't involve malware. Sender-recipient relationship, domain reputation, email headers, envelope attributes and email content will be analyzed. Custom rules will be integrated allowing group and user level controls to meet the needs of the client. Quarantines will enable the customer to separate email
Nathan Mueller’s employer, ReliaStar was acquired by the large insurance company ING in 2000. Mueller had a deep understanding of accounting systems and was in charge of transitioning his old employer to the new ERP system. Mueller learned “all aspects of the ERP system including financial reporting, journal entries, and most importantly, checks and wire payment processing” (“Lessons Learned,” 2014). Mueller was an accounting manager of the reinsurance division at one of ING’s offices. He stole almost $8.5 million in a little over four years. Mueller’s department at ING was the reinsurance division, which gave him the ability to approve company checks of up to $250,000. He embezzled this significant amount of money from his employer by requesting
Among all the communication mediums used in an organization, emails are used widely as an effective form of a business communication. From the company’s CEO to an employee of the business, emails are very easy and inexpensive. “Internal emails can function as an effective communication for sharing basic information, such as new cafeteria prices, paper use guidelines, or security precautions, for example. Sending simple messages to an entire workforce with just the click of a mouse is fast, easy, convenient and can save the company money”. (Lorette,
By doing this the message will go only to the original sender as opposed to the whole list of recipients. If replies are sent to all of the original recipients then each reply is also considered a mass mailing.
Security helps the organization meet its business objectives or mission by protecting its physical and financial resources, reputation, legal position, employees, and other tangible and intangible assets through the selection and application of appropriate safeguards. Businesses should establish roles and responsibilities of all personnel and staff members. However, a Chief Information Officer should be appointed to direct an organization’s day to day management of information assets. Supporting roles are performed by the service providers and include systems operations, whose personnel design and operate the computer systems. Each team member must be held accountable in ensuring all of the rules and policies are being followed, as well as, understanding their roles, responsibilities and functions. Organizations information processing systems are vulnerable to many threats that can inflict various types of damage that can result in significant losses (Harris, 2014). Losses can come from actions from trusted employees that defraud the system, outside hackers, or from careless data entry. The major threat to information protection is error and omissions that data entry personnel, users, system operators and programmers make. To better protect business information resources, organizations should conduct a risk analysis to see what
Marilyn Price and Donna Norris” (Perri, J.D., CFE, CPA, 2011, p. 23). Even though white collar crimes do not seem as violent as someone that commits murder there is still major damage done. For example, a fraud victim goes through a lot of hardship. They can be harassed, have their identity stolen, and lose everything. This, in many cases, can be looked at as a serious crime.
Abstract: Electronic mail is quickly becoming the most prevalent method of communication in the world. However, e-mail systems in corporate, institutional, and commercial environments are all potential targets of monitoring, surveillance and ultimately, censorship.
The ability to conduct warfare through technological methods has increased information security awareness and the need to protect an entity's infrastructure. Subsequently, cyber warfare produces increased risk to security practitioners that employ technology and other methods to mitigate risks to information and the various systems that hold or transmit data. A significant risk to information lies in the conduct of electronic commerce, hereinafter called e-commerce. E-commerce is the purchasing or selling of goods and/or services through the internet or other electronic means (Liu, Chen, Huang, & Yang, 2013). In this article, the researchers will discuss cyber warfare risks, present an evaluation of established security measures, identify potential victims of identity theft, and present an examination of the security of e-commerce companies....
Embezzlement is described in the book Criminology Today by Frank Schmalleger as, ”The unlawful misappropriation for personal use of money, property or other thing of value entrusted to the offender’s care, custody, or control”. One well known embezzlement case was discovered in 2008, it was perpetrated by Ausaf Umar Siddiqui a Pakistani American, better known a...
Champion, D 2011, ‘White-collar crimes and organizational offending: An integral approach’, International Journal of Business, Humanities, and Technology, vol. 1 no. 3, pp. 34-35.
It is also useful to consider not only these specific threats, but also the underlying themes that are of particular concern in recent years. Three such themes are terrorism, identity theft and internal fraud (that is, fraud committed by employees or other “insiders” in the organization).
Businesses are vulnerable to a variety of internal and external crimes that affects an organization’s performance. White-collar crime is a problem that cost American companies millions of dollars every day and negatively impacts the global economy in billions annually. This paper will identify the types of employee crimes, focusing on theft and the perpetrators; examine the impact to businesses and explore how business can deal with these offenses.
The first thing that we must consider about Information Security is that there is not a final destination at which we can arrive. IT Security is an ongoing set of processes and activities that requires attention and expertise on a daily basis. It is important to understand that systems are not secured by themselves and it is our responsibility to maintain and improve them periodically as required. It is of vital importance to establish the appropriate mechanisms and requirements in order to support the company’s CIA triad. The following report will provide you guidance about auditing and hardening techniques applied though the 7 Domains by utilizing IT Security Best Practices.