How Guardian Digital Stops Impersonation Attacks

Impersonation attacks such as CEO Fraud, Whaling, and Business Email Compromise are easy to build and easy to execute, even for malicious hackers who don’t have experience. Threat actors typically create fraudulent websites or send out fake emails from seemingly legitimate-looking domains.

Successful impersonation attacks evade the detection of most filters as they often don’t contain malicious links or payloads, making it one of the most successful scams for cyber thieves. Guardian Digital blocks these attacks using its unique multi-layered approach to email security. This article will discuss what a business impersonation attack is, and how Guardian Digital can help you effectively stop and prevent impersonation attacks.

How Guardian Digital Stops Impersonation Attacks

Guardian Digital goes beyond standard protection mechanisms with our targeted attack protection to uncover and prioritize advanced threats to stop all types of impersonation attacks. A business impersonation attack is the result of an attacker posing as a trusted person to steal or compromise sensitive information from a company or its customers. Companies of all sizes are vulnerable to this insidious type of attack. These low-volume, hard-to-detect threats are calculating, cannot be detected using conventional solutions, and are targeted at specific individuals within an organization. These threat actors may try to hack into the network of a company, access sensitive data, or transfer money from a legitimate account. The attack is usually carried out through fake websites, social networks, or emails.

Our intelligent systems succeed in detecting fraud with deep scanning for identity theft, whaling, CEO fraud, business email compromise (BEC) and email account compromise (EAC) beyond the abilities of regular signature-based systems. We utilize human and artificial intelligence to gain a deeper understanding of each internal and external relationship. Using deep content inspection, as well as your historical email patterns, Guardian Digital understands how your users use email within the organization. This allows us to offer the most effective protection against these imposter and social engineering attacks, unlike any other provider.

Guardian Digital brings together the most technologically advanced open-source developments, many standards-based security solutions, and the ingenuity and decades of our security expertise to create a cohesive, multi-layered enterprise email defense solution.

Among the prevention methods Guardian Digital uses to stop impersonation attacks include:

• Real-time checks of each message using the resources of systems from around the world (Big Data): big data can help stop impersonation attacks by analyzing large volumes of data from various sources to identify patterns and anomalies that may indicate fraudulent activity. With the help of machine learning algorithms, big data can identify potential impersonation attacks by analyzing user behavior, network traffic, and historical logs. By identifying these patterns and anomalies, big data systems can automatically trigger alerts or block suspicious activities, preventing impersonation attacks before they can cause significant damage. Additionally, big data can be used to monitor and identify potential threats in real-time, providing organizations with a more proactive approach to security.
• Sender-recipient relationship and data about how they use email: provides valuable insight into communication patterns between two individuals who exchange emails. These details include the frequency, content, and tone of messages sent between the parties. Analyzing data about email usage patterns can help detect anomalies or suspicious activity, such as unusual communication patterns or changes to message content or frequency. For example, if someone suddenly starts receiving an unusually large number of emails from a sender they have never previously communicated with, this could indicate a potential phishing or social engineering attack. 
• Domain reputation and age analysis help to block lookalike domains: two techniques used to detect and block lookalike domains used in phishing attacks. Lookalike domains appear similar to legitimate websites, but are controlled by cybercriminals who use them to trick users into divulging sensitive information or downloading malware. Domain reputation analysis involves the assessment of a domain's reputation by looking into various elements such as its history, content, and activity. This analysis can assist in recognizing domains that have been involved in phishing attacks in the past or are associated with suspicious behavior. Age analysis involves examining the age of a domain to determine whether it's likely legitimate or just another look-alike domain.
• Prevent sending unauthorized emails from being sent using your domain using SPF and DKIM: two email authentication protocols that help prevent email spoofing and shield your domain from being used in phishing attacks. Sender Policy Framework (SPF) is a protocol that permits you to specify which servers are authorized to send emails from your domain. Recipients can then use this information to determine if the email was sent from an authorized host. DomainKeys Identified Mail (DKIM) is an email authentication protocol that creates a digital signature on outgoing emails for recipients to confirm it hasn’t been modified in transit. Implementing SPF and DKIM on your domain can prevent unauthorized emails from being sent, protectinEnGarde Cloud Email Security Real-Time Dashboardg users against phishing attacks that use your domain as a spoofed sender. It can also help to ensure mail you receive from other senders actually came from an authorized sender.
• Authenticate email and prevent fraudulent use of your domain using DMARC: DMARC (Domain-based Message Authentication, Reporting & Conformance) is an email authentication protocol designed to prevent fraudulent use of your domain in email messages. It offers additional protection against email spoofing, phishing attempts, and other types of email-based scams. Implementing DMARC allows email providers to define policies for how receiving servers should handle emails that appear to come from your domain but weren’t sent by its authorized email servers. It works by defining policies based on SPF and DKIM records regarding how receiving servers should treat these emails.
• Artificial and Human Intelligence understands your relationships with your users and vendors: AI can assist by analyzing data from multiple sources such as customer interactions, purchase history, and social media activity to analyze patterns about your users' behaviors and preferences. By doing this, AI can assist in understanding your users and anticipating their needs. Human intelligence also gives a deeper insight into the relationships you have with both customers and vendors. HI can help you build trust with users and vendors, which is crucial for long-term success. Guardian Digital uses both technologies together for the greatest benefit.
• Display name spoofing: no matter what other techniques they employ, attackers will spoof the sender's display name in fraudulent email messages. When you read the message, the display name appears in the "From:" field. It is not related to the sender's email address or where replies are sent. It can be any name. Display name spoofing is where the attacker uses familiar names to gain the trust of the recipient. Our dynamic classification capabilities can detect, analyze, and block emails that spoof display names at the gateway.
• Dynamic classification: an additional layer of defense against email fraud attacks. Dynamic classification analyzes and manages email using several factors including its content, reputation, and relationship with the recipient. There are many factors that should be considered. Is the email from a trusted sender? Does that sender have an excellent reputation? Is the subject of the email suspicious? Are there any existing email relationships between the sender/receiver? Is the email's body suspicious? The email is scored based on the risk to the user. You can then decide what you do with the email based on that score.

“We’ve seen a dramatic increase in impersonation attacks over the last twelve months. They’re more sophisticated now than ever before, and virtually indistinguishable from an email originating from the actual sender. Relying on the default security provided by Microsoft 365 for these more sophisticated attacks proved to be inadequate, and was costing us the trust of our clients.”

- Gene Brown, BCMC Global, CEO

Guardian Digital goes beyond standard measures used in other solutions to protect our customers. Our fully managed cloud-based platform provides effective protection from known and emerging threats, built from the most technologically advanced open-source developments using our decades of email security expertise. This multi-layered enterprise email defense solution reduces the information technology overhead in even the largest organizations. Our customers also see increased visibility into their mail system to identify suspicious email activity and accelerate threat response with all the data on the threats targeting your users.

BCMC Global Gains Peace of Mind, Closes Microsoft 365 Security Gaps with Guardian Digital

When Gene Brown started BCMC Global a few years ago, he had a vision of connecting businesses internationally with event sponsors to identify the best opportunities available for their marketing efforts. 

Brown and his teaEmail Impersonating Gene Brown Blocked by Guardian Digitalm turned to Microsoft 365 email as the primary method of communicating with clients and conducting business. The magnitude of the risk to his clients and his own business became apparent when one of his clients received an email claiming to be from him (pictured on the right), just as they were discussing payment for their next media spend. The attacker compromised his client’s network, and monitored their discussions for months. Several key domain security features were not configured properly for BCMC Global which allowed this attack to occur, and the intruder capitalized on that.

BCMC has seen a dramatic increase in impersonation attacks that were more sophisticated than ever before, and virtually indistinguishable from an email originating from the actual sender. Brown said, relying on the default security provided by Microsoft 365 for these more sophisticated attacks proved to be inadequate, and was costing us the trust of our clients… This stealthy attack threatened our sensitive data and hard-earned reputation, and we determined that we couldn’t afford to wait any longer to secure Microsoft 365 email with reputable supplementary cloud email protection.”

Because of the rapid growth that Brown and his company were experiencing, the company needed an adaptive, scalable solution that could grow and evolve with it and its expanding client base. By implementing EnGarde, Gene Brown has been able to maintain BCMC Global’s hard-earned client trust and experience the invaluable peace of mind that their users and key business assets are safe from the damaging, costly cyberattacks and breaches that are rampant in Microsoft 365.

Learn More About Impersonation Fraud Protection

Learn more about how Guardian Digital can protect your organization against impersonation attacks and other malicious emails. Contact us for a free assessment of your current email security environment and a discussion about how Guardian Digital can help you close the email security gaps others leave unmonitored.

• Learn more about an effective email security solution that understands the relationships you have with other people while gaining a deeper knowledge of the types of conversations you have with them.
• Prepare your business for cyberattacks to make sure employees stay safe online.
• Improve your email security posture to protect against attacks and breaches by following our email security tips.
• Keeping the integrity of your email safe requires securing your email cloud with spam filtering and enterprise-grade anti-spam services.
• Avoid phishing attacks and ransomware with tips from our Behind the Shield newsletter.