1. ( Compromise)

2. Panelists Luke Emrich, EnCE, CEH, GCFA Director - Security, Privacy,
and Risk Services
Michael Waters, Esq., CIPP/US
Shareholder
Lauren Winchester, Esq., CIPP/US
Breach Response Services

3. Overview How and why email compromises occur
Best practices for responding to compromises
Response Costs
How to prevent compromises

4. Email compromises on the rise across industries
Data from BBR Services

5. How and why email compromises occur
From:
To:
Sent: September 10, 9:30 a.m.
Subject: Secure Message
This is a secured message for you and its confidential with password protection you have access to it with your working .
Jane Smith Director of Finance ABC Company
123 Washington St., Chicago, Illinois (312)

6. Motivation for Threat Actors - $$
Four common ways to leverage an inbox:
Reconnaissance/Targeted spam
Wire transfers
Payroll redirect
Sensitive information in the inbox

7. Best practices for responding to email compromises
Do we know the nature/type of the incident?
Do we know the incident timeline?
Identify the population of affected accounts
Were Phishing/Spam messages sent internally? – purge them!
Pull message trace logs for affected accounts
Change passwords for affected accounts
Check affected accounts for unauthorized rules - forwarding/move

8. Best practices for responding to email compromises
Do compromised creds provide access to additional systems?
Change passwords to potentially affected systems
Review logs for unauthorized access
Review Unified Audit logs for evidence of unauthorized access to affected accounts, including cloud apps like OneDrive and SharePoint.
Review Admin Audit logs for evidence of privilege escalation
Block any malicious addresses or domains

9. Potential Legal Implications
Unauthorized Access of Information
Statutory data breach notification obligations to individuals, regulators and business partners
This may include notification to investors, key customers, unfriendly parties (e.g., litigation adversaries)
Contractual obligations to third parties
Wire fraud
Recent lawsuits in which companies are sued due to wire and other fraud perpetrated from compromised account
If someone suffers a monetary loss because your account was compromised, you may be sued

10. Response Costs Legal Fees Potential for regulatory fines and penalties
Forensics
Programmatic and manual review of inboxes
Third party demands and/or lawsuits
Lost funds from fraudulent wire transfers
Notification and call center
Credit monitoring
Lost payroll funds

12. How to prevent email compromises
Harden your Environment (some suggestions below are specific to O365)
Require multi-factor authentication for all users
Limit or disable remote access (OWA)
Review Microsoft’s Secure Score and make suggested changes
Disable/Manage message forwarding
Turn on Unified Audit logging and Mailbox Auditing
Enable Advanced Threat Protection
Enabling Safe Links and Safe attachments
Security and Awareness Training / Social Engineering Testing

13. Questions?