Initial scoping and response
When responding to a BEC attack as an incident responder, the initial scoping phase is critical for understanding the breadth and depth of the incident. This phase involves gathering as much information as possible to assess the situation accurately. This initial scoping involves talking with the cloud productivity suite (Microsoft 365 or Google Workspace) IT administrators, organization general counsel, C-suite, and accounting staff to better understand the following, even before any technical forensic analysis:
- Timeline of the attack: Understanding when the attack started is crucial. Ask when the first signs of compromise were noticed and at what point users noticed anything suspicious. This could include unusual email activity, reports of suspicious emails from within or outside the organization, or financial transactions that were flagged as anomalous. If attackers were successful in transferring any unauthorized funds, note these dates in the...
