So, Aaron, we've talked about business email compromise for a while now.
If we wanted to summarize everything up, where would you start?
‑I mean,
my first thing I'd want to understand and probably we should put
some emphasis on is what actually is a BEC,
or business email compromise,
and how does it differentiate from some standard stuff that we've seen.
So, as we've talked about that,
I think we've seen that it's really different from just the original email.
There's a lot of complexity to it, it is very targeted,
and they're mainly after money,
and there's probably some more you could add to that as well.
‑Yeah, absolutely, I 100% agree with that.
I think the big thing that people need to understand is anybody
in any organization can be affected by this.
It's not targeting just a finance or health care or manufacturing,
it's targeting everybody, because every business,
whether it's a small mom‑and‑pop shop,
all the way up to like a Fortune 50 company,
is going to have somebody who pays bills,
and so anybody can be targeted.
‑Yeah,
that reaches right back to kind of the next point of
like what is that prevention point?
All of us pay bills, all of us have processes where we have to,
especially organizations, have to be able to send money back and forth somehow.
But there's ways that companies can change those processes,
like being able to double‑factor whether or not you send money,
like I need to call somebody and verify that the email and text with audio,
or whatever your process needs to be,
the process can also be the prevention tactic as well.
‑Yeah, absolutely.
And not only on the human side of the problem,
getting those processes in place,
there are some technical preventions that we can put into place as well.
Turning on multi‑factor authentication, yes,
it is not the end all be all of security,
it's not going to 100% prevent it,
but it's going to go a long way into helping prevent that.
Doing things like putting in anti‑phishing,
because again, BECs, they start with a phishing attack.
Stopping it at that point in the attack chain is going to
stop the whole attack from being successful.
‑Yeah, absolutely.
And then if, in case they are successful,
now we have to worry about detections like we do with any other type of attack.
Like they're always changing tactics,
and sometimes they can get past the phishing guards that they have up,
and so we want to make sure that we can detect on
these things that they do afterwards.
Like whether they get valid credentials from phishing,
we can check their geolocation and look for weird,
impossible travel logins,
we can do things like looking for those inbox rules that you
mentioned and the way that they're brought up,
and be able to really identify if this is already happening in our
environment or look for if they do get past those initial preventions
when it does happen in our environment.
‑Right, and once you detect that, then we move into the response.
We want to find the users that have been compromised.
We want to kill their active sessions, force a password reset,
and then start doing analysis on their little realm in the Office 365
or cloud environment or whatever you have set up.
You want to, again, look for those inbox rules to get them removed,
you want to look for any potentially malicious apps that could be
involved or associated with their accounts,
get those out there, because we want to contain the incident,
we want to prevent the attacker from being able to do anything else,
and we want to eradicate the incident and kick the attacker out
so that they can't do anything moving forward.
‑Yeah, and as you explained,
it really seems like their ability to do that is really predicated
upon how much money they're spending on licenses,
what data they have available to them, and that speaks directly to,
maybe you don't need to spend that money if you don't have sensitive
data that you're concerned about in the first place,
or if you don't do wire transactions that way,
then this isn't a consideration that you have to have.
So to me that really goes back to the unfortunate part of security,
the not so fun part of security is looking at kind of your risk matrix
and your business impact matrix and understanding,
yeah, this is a really scary thing that can happen,
but how much mitigation do I need to put around this so
that the mitigation doesn't cost more than the actual
problem happening in the first place.
‑Yeah, exactly.
This is a conversation that security people need to be
having with their senior leadership, with the people in charge,
with their accounting and financial departments,
so that they can understand what the risk is,
so that all the proper protections can be put into place,
all of the things that need to be put into place to detect,
prevent, and respond to this can happen in a very quick time,
should it need to happen.
‑Yeah, and to me,
this one differentiates itself a little bit because
when we add in the cloud environment,
when we add in the subscription models for Office 365 or Gmail
Enterprise or whatever it is that we're using,
what's interesting,
that's a different type of money math than I think the
standard maybe CISSO is even used to doing,
because they're now having to talk to the IT organization and say,
hey, we actually need a bumped‑up version of this user's account.
You're not trying to argue to get money to put in an IDS,
you're not trying to argue to get money to turn Sentinel Defender on,
that's not,
you're not trying to get money to fund like new people in your organization.
You're actually needing another organization to spend money to upgrade
licenses to be able to have the correct information that you need to do a
response or a detection in the first place.
‑And I think a good argument for the people,
or a good point for the people trying to make that argument is
you don't need to do this across the board.
It's not like if you have 100,000 users,
you need to upgrade 100,000 users to the next version of the license.
You can do it user by user,
so you pick and choose which users are most susceptible or
most at risk to an attack like this.
You upgrade their accounts so that you do have that
information should you need it.
It's all a guessing game on if you're going to need
this information in the future, but, again,
it comes down to the risk versus the reward.
If that were to happen at that time, you want to have that information.
It's going to save everybody a lot of headaches.
Yeah,
I think this being kind of a non‑standard or maybe not the
typical path from like a pure malware infection,
it can be a little bit scary to understand,
or maybe even ambiguous to understand where those endpoint packs are
that you can have a security organization to stop it,
though, I will say like you've done an excellent job explaining like,
hey, here's where, here's the things we can do to actually be successful,
and not just prevention, not just detection,
but also on what we can do when we respond to it,
and being able to scope everything properly.
It kind of takes it from this ambiguous,
scary like, oh, I'm not really sure how to handle this,
and we're adding in some cloud stuff to it that maybe I'm not used to,
to, oh,
this really just looks like any other attack with just
kind of slightly different tactics.
It's, if anything more hands on, like there's more human stuff,
even on the other side.
On the organizational, the criminal organization is more hands‑on and human,
so there's all that stuff that you can get around as well.
‑Yeah,
and I think the biggest takeaway that anybody should have from this is that,
yes, this is a major issue that's going on,
these attacks happen every day, however,
it is something that organizations can go in,
they can apply the right preventions, detections,
and response techniques to in order to stay ahead of it and
do what they need to do in order to minimize any impact
should something like that happen.
So it's a very, it's a problem that is very easily,
and I'm not going to call it solved, but able to be responded to,
able to be taken care of as best as possible.
‑Yeah, none of this has ever solvable, but it's definitely,
I would say,
solvable to any point that any of these other problems are with like
any other malware infection that we're talking about,
even though it's not technically malware.
‑Exactly.
‑Well, thanks for being here with me, Tyler.
I really appreciate your expertise, it's invaluable in this area.
You brought like so much to this, and even helped me understand it a lot more.
So a benefit for me, I get to learn a lot from this too.
Well, I appreciate you being here.
‑Yeah, absolutely.
Thank you for having me.
‑Yeah, thank you.
And thanks everybody for watching this Pluralsight
course on business email compromise.
We look forward to seeing you in the next one.