Hello, welcome to the Monday, August 14th, 2017 edition of the Santernut Storm Center's Stormcast.

My name is Johannes Ulrich, and the day I'm recording from Jacksonville, Florida.

Business email compromise is still a big issue, and Mark wrote up a brief diary about one particular common scenario that leads to this kind of attack. What happens

here is that a company uses Outlook Web Access and a user loses their credentials to fishing.

Whenever you have a web-based interface to access your email, then of course, anybody from anywhere in the world

typically can access that interface and then log in as that user and read emails, respond

to them, or delete them, so the legitimate user will never see them.

What happens typically here is that the hacker then either becomes more familiar with business

processes or directly sees for example an email from a customer asking for a buyer transfer

instructions which then of course are answered by the attacker on behalf of the legitimate owner of that email account,

which then leads to the funds being transferred to the wrong account.

I'm actually doing a brief webcast about this this afternoon today on Monday,

so if you want to learn more about business email compromise,

I'll go over some particular scenarios that I've seen in the past just using this and

similar schemes. Of course, if you have any kind of cloud-based web email, then the same

threat happens. I noticed that Google has actually gotten quite good in identifying

legitimate login attempts, but it doesn't mean that there aren't some that slip through Google's

defenses. The real solution here is probably two-factor authentication, also audit accounts for new forward addresses being added.

That's probably the most common scheme that I have seen where the attacker, instead of

continuing to log into the account, just adds a forward to address, so the hacker receives

copies of all emails.

Now, one way to educate your users about fishing, of course, is to conduct regular fishing tests to see how many people click on these emails and also demonstrate to your users

...