BUSINESS EMAIL COMPROMISE CHECK LIST

Summary from the TLDR InfoSec newsletter

A Business Email Compromise (BEC) incident response checklist for Office 365 outlines four phases: isolate the compromised account, contain the threat by resetting credentials and removing unauthorized configurations, eradicate traces of the attacker, and assess impact by reviewing sent emails and shared files. The response includes immediate actions like disabling accounts and changing passwords, followed by forensic analysis, stakeholder notification, and required regulatory reporting. Prevention through proper security measures is easier than incident response, but organizations must learn from incidents to strengthen defenses.