Scenario: A creditors clerk receives an e-mail appearing to come from a long-standing supplier advising that its banking details have changed, with a letterhead attached. The clerk updates the masterfile and pays R1,4 million to the new account. The sender’s domain is “suppl1er.co.za”, not “supplier.co.za”.
What type of attack is this, and which control would BEST have prevented the loss?

Question

Scenario: A creditors clerk receives an e-mail appearing to come from a long-standing supplier advising that its banking details have changed, with a letterhead attached. The clerk updates the masterfile and pays R1,4 million to the new account. The sender’s domain is “suppl1er.co.za”, not “supplier.co.za”.

What type of attack is this, and which control would BEST have prevented the loss?

Accepted Answer

Phishing using a look-alike domain that substitutes the digit one for the letter i; the control is independent verification of any banking-detail change by telephoning a previously known number, with segregation between amending the masterfile and authorising payment

Answer

Business e-mail compromise following the takeover of the supplier’s genuine mailbox; the control is to require every supplier to digitally sign its e-mail so that authenticity can be verified cryptographically before any change is actioned

Answer

A man-in-the-middle attack intercepting and altering the supplier’s e-mail in transit; the control is to enforce TLS on the mail gateway and require remote staff to connect through a VPN

Answer

An insider threat, since only someone with masterfile access could redirect a payment of this size; the control is enhanced background screening of finance staff together with compulsory job rotation and leave

Crowdly

Scenario: A creditors clerk receives an e-mail appearing to come from a long-sta...

Want instant access to all verified answers on mymodules.dtls.unisa.ac.za?