Amongst all cybercrime, phishing attacks continue to be the most prevalent today. With over 90 percent of attacks coming via email, it’s important that every organization has a plan to prevent these threats from reaching users. 

With Microsoft, we’re passionate about providing our customers with simplified and comprehensive protection against such threats with Defender for Office 365.

Email Security, Q2 2021 represents the latest validation of our relentless effort, strategy, and focus to keep our customers secure and offer industry-leading protection against threats orchestrated over email and collaboration tools.

That is why we’ve been working aggressively to protect customers by detecting and blocking attacks through innovation in our products and by staying ahead of current and future threats through research.

What is a business email compromise?

The term itself has seen an evolution over the years, but quite simply business email compromise (BEC) is a type of phishing attack that targets organizations with a view to stealing money or sensitive information. At its core, it’s a social engineering attack, where the attacker looks to dupe the target into believing that they are interacting with a trusted entity. Once they have deceived their target, the attacker proceeds to coax them to share valuable information or process a payment.

These attacks are sometimes referred to as ‘CxO Fraud’ or ‘vendor compromise,’ taking the name of the entity the attacker is claiming to be.

How are these attacks planned?

BEC attacks are so dangerous and costly that we recently devoted an entire blog series to this topic in an effort to raise visibility and help protect customers. The blog series covers the various types of tactics used in BEC attacks and the different levels of sophistication we see in these attacks. But I’ll summarize some top takeaways here:

Generally, the attacker uses one of the tactics below to dupe a target.

• Look-alike tactics (like domain or user impersonation):

• • • For example, the attacker can forge the email properties of an email to make the sender appear to be a trusted entity. They can achieve this by using the same display name, even if using a different address. Or they can choose very subtle changes in the user part or domain part of the email address to make the email appear visually similar to a trusted email address, such as CEO@micros0ft.com (notice the ‘0’ instead of ‘o’—which upon cursory inspection, might not be obvious to the target).

• Exact-domain spoofing:

• • In this case, the attacker forges the email to use the exact same email address as the ‘trusted entity’—but sent from an email infrastructure they own. This is made possible by improperly protected domains (Email domains without domain authentication standards like DMARC enforced).

What is Microsoft doing to combat security threats?

Microsoft has been working on a multi-pronged approach to keep customers safe. One that leverages our massive scale of optics and signals across our service portfolio to drive advancements in three dimensions:

• Product innovation.
• Research focuses to keep track of ever-shifting campaigns and strategies.
• Fighting crime and taking down attack networks.

Product innovation in Microsoft Defender for Office 365

Defender for Office 365 offers customers unparalleled protection from business email compromise and other attacks such as credential phishing, whaling, malware, ransomware, and much more that might be orchestrated over email or other collaboration vectors. In an era of ever-increasing cybercrime, protection from such attacks is critical for organizations to safeguard their users.

The massive scale of protection offered means that each month Defender for Office 365 detects and blocks close to 40 million emails containing BEC tactics. We block 100 million emails with malicious credential phishing links each month. And each month, we detect and thwart thousands of user compromise activities.

This level of protection is paired with innovative and comprehensive product capabilities that span the different spheres of protection captured below—blocking and detecting threats, maximizing the efficiency and effectiveness of security teams as they investigate, hunt for, and respond to threats, and focusing on capabilities that help raise end-user awareness and preparedness for these social engineering attacks. All of these play a critical role in protecting organizations from BEC attacks.

Take steps now to protect your organization

Fighting cybercrime and eliminating costly breaches is going to take all of us. At Microsoft, we’ll continue to focus on the pivots we covered above to keep our customers protected. But to supplement that, it’s important that each and every organization take the threat of business email compromise seriously. CISOs need to ask themselves: Do we have the right level of protection against these attacks?

These are important measures to take to protect your users against a possibly expensive breach:

1. Upgrade to an email security solution that provides advanced phishing protection, business email compromise detection, internal email protection, and account compromise detection.
2. Complement email security with user awareness and training.
3. Implement multi-factor authentication to prevent account takeover and disable legacy authentication.
4. Review your protection against domain spoofing.
5. Implement procedures to authenticate requests for financial or data transactions and move high-risk transactions to more authenticated systems.

If you want to Secure your Business to a Bank-Level Security with Microsoft, Request here so our experts can reach out and Advice on what should be done.