Bir Pazartesi sabah\u0131 muhasebe veya finans departman\u0131n\u0131zdaki yetkili personelinize \u015firket Genel M\u00fcd\u00fcr\u00fcnden (CEO) acil bir e-posta geldi\u011fini d\u00fc\u015f\u00fcn\u00fcn:<\/p>\n
“\u00c7ok gizli bir sat\u0131n alma s\u00fcrecindeyiz. \u015eu an toplant\u0131day\u0131m, telefonumu a\u00e7am\u0131yorum. Ekteki tedarik\u00e7i IBAN numaras\u0131na 450.000 TL transfer yap\u0131p dekontunu bana iletir misin?”<\/em><\/p>\n Gelen e-posta adresi, profil ad\u0131 ve imza \u015fablonu ilk bak\u0131\u015fta \u015firket CEO’sunun orijinal e-postas\u0131yla neredeyse birebir ayn\u0131d\u0131r. Personel panikle transferi ger\u00e7ekle\u015ftirir ve dakikalar i\u00e7inde \u015firket b\u00fct\u00e7esi geri d\u00f6n\u00fclemez bir doland\u0131r\u0131c\u0131l\u0131k hesab\u0131na aktar\u0131lm\u0131\u015f olur.<\/p>\n Siber g\u00fcvenlik literat\u00fcr\u00fcnde bu sald\u0131r\u0131 modeline Business Email Compromise (BEC)<\/strong> ya da T\u00fcrk\u00e7e ad\u0131yla CEO Doland\u0131r\u0131c\u0131l\u0131\u011f\u0131 (Oltalama)<\/strong> ad\u0131 verilir. FBI verilerine g\u00f6re BEC sald\u0131r\u0131lar\u0131, fidye yaz\u0131l\u0131mlar\u0131ndan (ransomware) bile daha fazla finansal kayba yol a\u00e7makta ve d\u00fcnya genelinde y\u0131lda milyarlarca dolar<\/strong> zarara neden olmaktad\u0131r.<\/p>\n Bu kapsaml\u0131 rehberde; CEO sahtekarl\u0131\u011f\u0131n\u0131n anatomisini, sald\u0131rganlar\u0131n kulland\u0131\u011f\u0131 psikolojik ve teknik taktikleri, sahte iletilerin nas\u0131l tespit edilece\u011fini ve \u015firket \u00e7al\u0131\u015fanlar\u0131n\u0131z\u0131 bu tehdide kar\u015f\u0131 nas\u0131l koruyaca\u011f\u0131n\u0131z\u0131 inceliyoruz.<\/p>\n Sald\u0131rganlar rastgele bir mail atmak yerine, \u00f6ncelikle LinkedIn, Ticaret Sicil Gazetesi ve kurumsal web siteniz \u00fczerinden \u015firketin hiyerar\u015fik yap\u0131s\u0131n\u0131 haritaland\u0131r\u0131r:<\/p>\n Sald\u0131rganlar \u015firket alan ad\u0131n\u0131z\u0131n neredeyse farks\u0131z bir benzerini sat\u0131n al\u0131r:<\/p>\n G\u00f6zle dikkatlice incelenmedi\u011finde al\u0131c\u0131 personel mailin ger\u00e7ekten \u015firket i\u00e7inden geldi\u011fini zanneder.<\/p>\n E\u011fer \u015firket y\u00f6neticisinin e-posta \u015fifresi zay\u0131fsa veya iki a\u015famal\u0131 do\u011frulama (2FA) kullan\u0131lm\u0131yorsa, sald\u0131rgan do\u011frudan ger\u00e7ek e-posta hesab\u0131na s\u0131zar. G\u00fcnlerce sessizce gelen\/giden kutusunu izler, \u015firketin fatura kesme tarihlerini ve hitap dilini \u00f6\u011frenir; ard\u0131ndan en kritik anda devreye girer.<\/p>\n \u015eirketinizin d\u00fczenli \u00e7al\u0131\u015ft\u0131\u011f\u0131 bir lojistik veya hammadde tedarik\u00e7isinin e-posta sistemi ele ge\u00e7irilir. Ger\u00e7ek tedarik\u00e7i kimli\u011fiyle g\u00f6nderilen faturada “Bankam\u0131z de\u011fi\u015fmi\u015ftir, yeni IBAN hesab\u0131m\u0131za \u00f6deme yap\u0131n\u0131z”<\/em> denilerek \u015firket \u00f6demesi doland\u0131r\u0131c\u0131lar\u0131n hesab\u0131na y\u00f6nlendirilir.<\/p>\n \u00c7al\u0131\u015fanlar\u0131n\u0131za a\u015fa\u011f\u0131daki 6 kural\u0131 bir kurum k\u00fclt\u00fcr\u00fc olarak a\u015f\u0131layarak BEC sald\u0131r\u0131lar\u0131n\u0131 %95 oran\u0131nda \u00f6nleyebilirsiniz:<\/p>\n Yaln\u0131zca personel dikkati yeterli de\u011fildir; kurumsal e-posta altyap\u0131n\u0131z\u0131n teknik d\u00fczeyde bu sahtekarl\u0131klar\u0131 kap\u0131da engellemesi gerekir:<\/p>\n DMARC kayd\u0131, alan ad\u0131n\u0131z ad\u0131na d\u0131\u015far\u0131dan sahte e-posta g\u00f6nderilmesini engelleyen en g\u00fc\u00e7l\u00fc kalkand\u0131r. Politikan\u0131z\u0131 \u015eifreler \u00e7al\u0131nsa veya oltalama ile ele ge\u00e7irilse dahi, SMS veya Authenticator uygulamas\u0131 olmadan sald\u0131rganlar Webmail veya posta kutular\u0131na giri\u015f yapamaz.<\/p>\n \u015eirket d\u0131\u015f\u0131ndan gelen t\u00fcm maillerin en \u00fcst\u00fcne Mail Gateway taraf\u0131ndan otomatik olarak:<\/p>\n uyar\u0131s\u0131 eklenmelidir. Bu sayede y\u00f6neticinin ad\u0131n\u0131 taklit eden harici mailler an\u0131nda fark edilir.<\/p>\n Gelen iletileri yapay zek\u00e2, alan ad\u0131 benzerlik algoritmalar\u0131 (lookalike domain detection) ve itibar testlerinden ge\u00e7iren kurumsal filtreler, CEO sahtekarl\u0131\u011f\u0131 ama\u00e7layan domainleri kullan\u0131c\u0131ya ula\u015fmadan karantinaya al\u0131r.<\/p>\n E\u011fer bir \u00e7al\u0131\u015fan\u0131n\u0131z sahte bir maile inanarak para transferi yapt\u0131ysa:<\/p>\n
\n⚡ H\u0131zl\u0131 Bak\u0131\u015f: Geleneksel Spam ile BEC Sald\u0131r\u0131s\u0131 Aras\u0131ndaki Fark<\/h2>\n
\n\n
\n \nKriter<\/th>\n Standart Oltalama \/ Spam<\/th>\n CEO Doland\u0131r\u0131c\u0131l\u0131\u011f\u0131 (BEC)<\/th>\n<\/tr>\n<\/thead>\n \n Hedef Kitle<\/strong><\/td>\n Rastgele binlerce ki\u015fiye toplu at\u0131l\u0131r.<\/td>\n \u015eirket y\u00f6netimi, finans ve sat\u0131n alma personeli \u00f6zel olarak hedeflenir.<\/td>\n<\/tr>\n \n Zararl\u0131 Yaz\u0131l\u0131m \/ Link<\/strong><\/td>\n Genellikle vir\u00fcsl\u00fc .exe<\/code>, makrolu .doc<\/code> veya phishing linki i\u00e7erir.<\/td>\nGenellikle hi\u00e7bir link veya vir\u00fcsl\u00fc dosya i\u00e7ermez;<\/strong> sadece metin ve aciliyet psikolojisi kullan\u0131l\u0131r.<\/td>\n<\/tr>\n \n Filtreleri A\u015fma Ba\u015far\u0131s\u0131<\/strong><\/td>\n Standart antivir\u00fcs ve antispam yaz\u0131l\u0131mlar\u0131 kolayca yakalar.<\/td>\n \u0130\u00e7erikte zararl\u0131 kod olmad\u0131\u011f\u0131 i\u00e7in s\u0131radan filtreleri rahatl\u0131kla atlat\u0131r.<\/td>\n<\/tr>\n \n Ortalama Finansal Zarar<\/strong><\/td>\n Bireysel d\u00fczeyde d\u00fc\u015f\u00fck \/ orta risk.<\/td>\n \u015eirket \u00f6l\u00e7e\u011finde y\u00fcz binlerce lira ve d\u00f6viz kayb\u0131.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n
\n1. CEO Doland\u0131r\u0131c\u0131l\u0131\u011f\u0131 (BEC) Nas\u0131l \u00c7al\u0131\u015f\u0131r? 3 Yayg\u0131n Senaryo<\/h2>\n
Senaryo A: Sahte Alan Ad\u0131 ile Kimlik Taklidi (Typosquatting)<\/h3>\n
\n
atlas-holding.com.tr<\/code><\/li>\natIas-holding.com.tr<\/code> (b\u00fcy\u00fck I harfi ile l harfi taklidi)<\/em> veya atlas-holdlng.com.tr<\/code><\/li>\n<\/ul>\nSenaryo B: Do\u011frudan Y\u00f6netici Hesab\u0131n\u0131n Ele Ge\u00e7irilmesi (Account Takeover)<\/h3>\n
Senaryo C: Tedarik\u00e7i Fatura ve IBAN De\u011fi\u015fikli\u011fi Sahtekarl\u0131\u011f\u0131<\/h3>\n
\n2. \u015e\u00fcpheli Bir E-postay\u0131 Ele Veren 6 K\u0131rm\u0131z\u0131 Bayrak (Red Flag)<\/h2>\n
\n
ceo@sirketiniz.com<\/code> g\u00f6r\u00fcnse bile, farenizi \u00fczerine getirdi\u011finizde veya “Yan\u0131tla” butonuna bast\u0131\u011f\u0131n\u0131zda al\u0131c\u0131 adresinin yabanc\u0131 bir adrese (ceo-office-mail@gmail.com<\/code> vb.) d\u00f6nmesi.<\/li>\n
\n3. \u015eirketinizi Korumak \u0130\u00e7in Al\u0131nmas\u0131 Gereken Teknik \u00d6nlemler<\/h2>\n
1. DMARC Politikas\u0131n\u0131
p=reject<\/code> Seviyesine Y\u00fckseltin<\/h3>\np=reject<\/code> yapt\u0131\u011f\u0131n\u0131zda, sald\u0131rganlar domaininizi taklit ederek \u015firket personelinize e-posta g\u00f6nderemez; d\u00fcnya genelindeki sunucular bu sahte mailleri do\u011frudan imha eder.<\/p>\n2. T\u00fcm Kullan\u0131c\u0131larda \u0130ki A\u015famal\u0131 Do\u011frulamay\u0131 (2FA) Zorunlu K\u0131l\u0131n<\/h3>\n
3. D\u0131\u015f Kaynakl\u0131 E-postalara Otomatik G\u00fcvenlik Uyar\u0131s\u0131 Ekleyin<\/h3>\n
[D\u0130KKAT: Bu e-posta \u015firket d\u0131\u015f\u0131 bir kaynaktan gelmi\u015ftir. Para transferi ve \u015fifre taleplerine dikkat ediniz]<\/code><\/p>\n4. Geli\u015fmi\u015f Mail Gateway (MG) Filtreleme Katman\u0131 Kullan\u0131n<\/h3>\n
\n4. Olas\u0131 Bir Sald\u0131r\u0131da \u0130lk 30 Dakikada Ne Yap\u0131lmal\u0131?<\/h2>\n
\n
\n🛡️ ProMail ile \u015eirket E-postalar\u0131n\u0131z %100 G\u00fcvende<\/h2>\n