Detecting and Responding to Email Account Compromise (regarding FINRA 12-05, ISAC/IC3 alerts)

Question

FINRA, the ISAC and IC3 issued an alert regarding e-mail based attacks that attempt to obtain client contact information. They then use social engineering / persuasion to complete the attack.

• What should the IT Security department of a Broker/Dealer do to specifically address and mitigate these threats?

• What technical solutions should be put in place? (or be enhanced accordingly)

• Does anyone have additional information on these attacks? (e.g. breadth, scope, etc?)

Answer 1

If you look at the guidance provided, they give a couple of specifics that are relevant for IT Security:

• Perform out-of-band authentication and verification of the payment instructions through a validated contact channel.

Ensure your controls are enforced so that individuals cannot sidestep your current out-of-band authentication and verification

• Leverage payment instruction and transaction anomaly tools to flag suspect transactions.

If you run statistical analysis tools to alert on anomalies, they may well already be picking up this sort of wire transfer fraud.

• Use traditional security tools (DLP, spam filters, etc.) to search for e-mails with key words like “wire + funeral”, or “wire + travel,” etc. Clients and employees noted in 3 flagged messages should then be contacted directly by other resources within your financial institution.

This is probably the key IT control here - even a basic DLP solution should allow you to search for these words at your mail gateway, which can pick this up rapidly.

It is a fairly standard social engineering attack, relying on the financial institution wanting to be as helpful as possible to the customer in dire straits. As staff are only human, enforcing IT controls is the simplest way to avoid a 'helpful' member of staff bypassing procedures and then becoming a victim.