Latest / Privacy Please / S5, E226 - Building a Secure Culture Against BEC Scams

Transcript

S5, E226 - Building a Secure Culture Against BEC Scams · Privacy Please

• 0:00
  Speaker 1: All righty, then.
• 0:02
  Speaker 1: Ladies and gentlemen, welcome back to another episode of Privacy, please.
• 0:06
  Speaker 1: I'm your host, cameron Ivey, and this is the show where we break down complicated tech stuff into bits everyone can understand.
• 0:14
  Speaker 1: Today, we're going to be exploring the insidious world of business email compromise, also known as BEC scams, a $26 billion criminal enterprise, according to the FBI.
• 0:25
  Speaker 1: Let's dig in.
• 0:38
  Speaker 1: Business email compromise scams involve con artists impersonating your boss or coworkers to trick you into transferring money or divulging sensitive information.
• 0:48
  Speaker 1: Here's how to spot them and stop them.
• 0:52
  Speaker 1: Number one question urgency.
• 0:54
  Speaker 1: Scammers rely on creating a false sense of urgency to cloud your judgment.
• 0:58
  Speaker 1: Ronnie Takasowski, a seasoned security researcher, emphasizes if an email elicits an emotional response, take a step back and reread it when you're more calm.
• 1:10
  Speaker 1: Sleep on it.
• 1:11
  Speaker 1: Take a second.
• 1:12
  Speaker 1: Don't respond right away.
• 1:14
  Speaker 1: This emotional manipulation is key to their success.
• 1:18
  Speaker 1: Selena Larson from Proofpoint advises slow down, take a deep breath and walk away from your computer or phone and think critically.
• 1:27
  Speaker 1: Number two confirm through a second channel.
• 1:30
  Speaker 1: Always verify suspicious requests through a different communication method.
• 1:34
  Speaker 1: Larson's warns do not rely on a phone number in the email itself.
• 1:38
  Speaker 1: It will be owned by the threat actor.
• 1:40
  Speaker 1: Use the known contact details of secure channels like Slack or Microsoft Teams.
• 1:44
  Speaker 1: Even if the request seems urgent, it's crucial to confirm its authenticity.
• 1:48
  Speaker 1: Number three check the email address.
• 1:50
  Speaker 1: Examine the sender's email address closely.
• 1:54
  Speaker 1: Scammers often use lookalike domains to appear legitimate.
• 1:58
  Speaker 1: Larson notes that lookalike domains are very common.
• 2:01
  Speaker 1: Someone will do a slight variation, like a capital I instead of a lowercase I to make it look legitimate.
• 2:07
  Speaker 1: If you're suspicious, paste the domain into a browser to verify its authenticity.
• 2:13
  Speaker 1: Just take that extra step.
• 2:14
  Speaker 1: The next one is follow proper protocols.
• 2:17
  Speaker 1: Stick to established company procedures for financial transactions and information updates.
• 2:22
  Speaker 1: Another source points out there needs to be a paper trail.
• 2:25
  Speaker 1: Someone saying purchase this from your personal account is a process that just wouldn't happen.
• 2:31
  Speaker 1: So if it seems weird or uncommon or you feel like those spider tinglys oh yeah, we got them Go with your instinct on that.
• 2:39
  Speaker 1: The next one is foster open communication.
• 2:41
  Speaker 1: This is key.
• 2:42
  Speaker 1: Leaders should cultivate a culture of transparency anywhere right.
• 2:46
  Speaker 1: One of the sources suggests that skip level meetings to enhance communication across all levels of the organization.
• 2:52
  Speaker 1: Larson's adds that talking about scams openly helps the person, their peers and their colleagues learn how to protect themselves.
• 3:00
  Speaker 1: Build that confidence within your team.
• 3:02
  Speaker 1: By staying vigilant and having open communication, you can protect yourself and your organization from these sophisticated scams.
• 3:08
  Speaker 1: Remember it's better to verify and be safe than assume and be sorry, andy sawy.
• 3:15
  Speaker 1: That's all for this week, folks.
• 3:17
  Speaker 1: If you want to learn more, feel free to reach out and we'll catch you guys on the next one.
• 3:21
  Speaker 1: Cameron Ivey, over and out.