01865 364995
24/7 Account Monitoring and Threat Detection
24/7 monitoring, intelligent threat detection, and expert remediation to stop Business Email Compromise attacks and ensure uninterrupted business operations.
Why Choose 24/7 Account Monitoring and Threat Detection?
Most businesses now rely on cloud services every day, from email and file sharing to finance systems and customer data. While these tools make it easier to work from anywhere, they also create more opportunities for cybercriminals. One of the most common threats is Business Email Compromise (BEC), where attackers impersonate someone you trust to trick you into making payments, sharing sensitive information or providing access to your systems.
These attacks are becoming harder to spot, particularly as cybercriminals use AI to create more convincing and personalised messages. With attempted compromises becoming increasingly common, every business should assume it will be targeted at some point. Having the right security in place, alongside employees who know what to look out for, can make the difference between an attempted attack and a costly breach.
What does it do?
The 24/7 Account Monitoring service continuously evaluates user activities and system logs to detect suspicious behaviour and potential identity-related threats in real-time. Backed by a team of identity threat experts, detection engineers, and security operations specialists operating 24/7.
Be it unwanted logins, shadow workflows, evasive behaviors, or rogue apps, 24/7 account monitoring is the first line of defense against identity-focused cyber attacks like credential theft, session hijacking, malicious inbox and forwarding rules, and account takeover and Business Email Compromise.
It integrates seamlessly with your Microsoft or Google Cloud environment, gathering user, tenant, and application data, and then enhancing it with insights from both internal and external threat feeds to provide details like geo-location and IP reputation. This information empowers the system to provide precise and detailed incident reports, complete with mitigation steps to swiftly neutralise threats.
How does the Account Monitoring and Threat Detection work?
Collect
The platform continuously captures event data, correlating user actions like policy changes, login events, and mail flow manipulation to jumpstart the detection efforts.
Detect
The Security Operations Centre (SOC) analysts and threat detection engineers use detection logic to review ingested data and make contextual insights quickly.
Escalate
Sometimes analysts need more information to establish if something unknown is malicious. Escalations empower partners to advise (via Unwanted Access rules) if an activity is Expected or Unauthorised.
Analyse
Analysts dig deep into the data and scrutinise Unwanted Access rules to identify real threats, cutting through the noise and false positives.
Report
An incident report that summarises findings and outlines any next steps that should be taken is provided.
Remediate
In some cases, the platform will automatically log out and disable an identity on your behalf when malicious activity is detected. If not, clear, detailed instructions are provided for any manual actions.
The platform is recognised by cybersecurity insurance providers, which regularly enables businesses to check more boxes when applying for coverage due to 24/7 monitoring for threats and rapid isolation when an incident is detected.
Some of the most common Business Email Compromise attacks that organisations face globally are:
Invoice Fraud
Attackers compromise the email account of a legitimate vendor or supplier and use their email to send fake invoices to the targeted organisation. The invoices contain payment details that will result in any funds paid being transferred to the attacker’s account instead of the legitimate vendor’s account.
Invoice Interception
Similar to invoice fraud, Invoice Interception targets the vendor’s email account. Attackers compromise the vendor’s email account, then intercept outgoing emails with legitimate invoices, but change the payment details in the invoice prior to sending the invoice. This type of attack leverages the trust established between the vendor and their customer as well as the fact that the customer is expecting an invoice for a specific amount already.
Employee Payroll Diversion
Attackers compromise an employee’s email account, then contact HR or finance to change the direct deposit information for the employee’s paycheck. This results in the employee’s salary being redirected to the attacker’s account.
Executive Impersonation
The threat actor compromises the email account for a high-level executive in the company, then emails other employees from that account asking them to urgently purchase gift cards or another kind of easily laundered asset. The stated reason for the purchase is that they need it for a last-minute company award, or to give out at a convention.
IT Administrator Compromise
Threat actors breach the IT administrator’s account, which can globally administer the company’s Microsoft 365/Google Workspace instance. This enables them to read and edit the emails of any employees, add more admin users to maintain their access, and even set up new cloud resources they can use to launch further attacks against the targeted company or other businesses.
Legal Intimidation
The attacker compromises the account for a member of a legal firm, then uses that account to solicit payments for legal services or to pressure a victim into transferring funds to avoid a lawsuit.
Suspicious indicators to look out for in emails:
Spoofed Sender Information
Attackers manipulate the “From” field to display a sender’s name or email address that appears legitimate, even though it may not be.
Urgent or Threatening Language
Phishing emails often create a sense of urgency or fear to encourage recipients to take immediate action without thinking.
Hyperlinks to Malicious Websites
Phishing emails contain links that direct recipients to fraudulent websites designed to collect sensitive information, install malware, or perform other malicious activities.
Malicious Attachments
Some phishing emails include attachments, such as infected documents or compressed malware. When opened, these attachments can infect the recipient’s computer.
Fake Logos and Branding
Attackers replicate logos, branding, and visual elements of legitimate organisations to create a false sense of authenticity.
Grammar and Spelling Errors
While attackers are becoming more sophisticated, some phishing emails may still contain language errors that hint at their illegitimacy.
Request for Sensitive Information
Phishing emails often request recipients to provide confidential information like passwords, credit card numbers, or Social Security numbers.
Unusual Sender Requests
The email might request unusual actions, such as transferring funds to an unfamiliar account or providing sensitive information via email.
How to protect your organisation from BEC attacks.
Employee Training and Awareness
- Tools that focus on educating employees about threats and making them aware of suspicious indicators of phishing are key to success.
- Perform routine simulated phishing attacks, where suspicious emails using tactics of real attackers are sent out to employees. This can help employees apply knowledge gained via training and reinforce those concepts so they can avoid being compromised during a real attack.
- Send out regular bulletins that highlight the most recent phishing and BEC tactics seen so that employees can continue to build their knowledge.
- Implement written policies that help safeguard employees when faced with attacker scenarios.
Examples include: - Any email requests for change in financial information must be verified by a phone call for transactions over a certain amount.
- Gift card purchases may only be made by specific individuals who are pre-authorised in advance by the finance department.
Multi-Factor Authentication (MFA)
- By requiring more than one form of authentication, enforcing MFA will lessen the chance of malicious threat actors gaining access to a user’s login credentials.
- MFA should still be coupled with a strong password policy and awareness training to prevent users from entering their credentials in fake phishing schemes.
Conditional Access Policies
- This Microsoft 365/Azure offering enforces that particular controls are satisfied before a user is granted access. For example, a user must sign in from a particular geo-location or must be using an onboarded device to gain access.
- Conditional access policies make it more difficult for a threat actor to log in, even if they manage to phish user credentials and convince the user to provide their MFA token for login on a fake site.
Find Out More
Fill in the form here to request a call back or call us now on 01865 364995 to find out more.