Imagine a message arrives from a familiar vendor: "Hello, starting with the next invoice, our bank details have changed. Confirmation attached."
The name is right. The signature looks familiar. The invoice looks the same as always. There is only one change: the bank account.
Sometimes a cyber attack does not need to break into a server. It only needs to get an employee to carry out a legitimate action for the wrong person.
Why finance in particular?
Because that is where the money moves. The finance team receives invoices, makes payments, handles bank details, works with vendors, and sometimes receives requests from managers. For an attacker looking for financial gain, it is a natural point of interest.
The person on the other side does not have to be a "hacker" as you imagine one
They are not necessarily trying to break through a firewall. Sometimes they are building a story: who is the CEO? Who are the vendors? What do the email addresses look like? Who works in finance? What deals are going on?
Some of this information can be obtained from open sources or from correspondence that has been exposed. Then a message is created that looks reasonable.
Urgency is a tool
"Do it today." "I'm in a meeting and can't talk." "The vendor is waiting for payment." "It's urgent."
When an employee feels they are holding up a deal or a senior manager, they may skip checks they would normally do. Social engineering does not always try to break the technology. It tries to bypass judgment.
This is where a business process becomes a security control
Suppose company procedure says that a change to a vendor's bank details requires verification through a separate channel with a known contact. Suddenly a single email is no longer enough. Or an unusual financial transaction requires additional approval. Or requests from management do not override normal controls.
These are business processes, but they have a direct impact on cyber security.
What if the email really did come from the vendor?
That is exactly the point. Sometimes the attacker does not spoof an address. They take over a real account, and in that case the message can arrive within a completely genuine email thread. So a check that relies only on "is this a known address?" is not always enough. It is also one of the reasons to review your organization's Microsoft 365 security.
MFA is very important, but it is not a solution to every fraud
MFA can significantly reduce the risk of account takeover. But fraud can also be carried out through a look-alike domain, external impersonation, a compromised vendor account, a phone call or WhatsApp. Good protection combines technology and process.
Not only finance
HR holds personal data. Sales communicates with customers. Management holds sensitive information. IT holds permissions. Every department can be a target for a different reason.
That is why "information security" that does not reach beyond the IT department is partial, and a good cyber risk assessment also examines business processes.
Employee training cannot be the entire line of defense
It is easy to say "the employee should pay attention". But employees are busy working. They are under pressure, receive hundreds of messages and carry out repetitive tasks.
So the goal is not to create an organization where mistakes are not allowed. The goal is to create several layers, so that a single mistake does not immediately become a significant incident.
Cyber as a business process with Marom Cyber
Marom Cyber helps organizations examine cyber risk through their business processes too, not only through infrastructure. It is part of our information security and cyber advisory services.
Frequently asked questions
Sometimes the most important layer of protection is not another security product. It is a process that does not let a single email change where the company's money is sent. Talk to us about reviewing your sensitive business processes.