1.2 Common Threats in Corporate Environments

• Business Email Compromise (BEC): A highly sophisticated scam where attackers compromise legitimate corporate email accounts to conduct unauthorized fund transfers.

  BEC attacks are often “malware-free”, relying entirely on social manipulation rather than technical exploits.

• Insider Threats: Security risks that originate from within the organization.
  • Malicious Insider: A disgruntled employee stealing IP (Intellectual Property) before leaving to join a competitor.
  • Negligent Insider: A well-meaning employee who bypasses security policies (e.g., emailing sensitive data to a personal Gmail account) to “get the job done” faster.
• Supply Chain Attacks: Attackers compromise a trusted third-party vendor (such as an HVAC provider or payroll processor) to gain indirect access to your corporate network.

  You are only as secure as your least secure vendor.