Zero-trust access and BEC-proof email for a Los Angeles real-estate group
A real-estate development and brokerage group in Los Angeles County, a leader in its segment.
- Scale
- 150 staff, multiple offices and job sites, high-value wire transfers
- Engagement
- Assessment, rollout and ongoing management over 10 weeks
The challenge
Business email compromise is the main threat to real-estate closings: an attacker who impersonates a title agent or executive can redirect a six-figure wire. The group also had staff working from job sites and home on whatever device they had.
Real-estate transactions combine large sums, tight deadlines and many outside parties, which is exactly what business email compromise exploits. An attacker who impersonates a title agent or executive can redirect a six-figure wire. The group also had staff working from job sites and home on whatever device they had, and a broad VPN that gave anyone who connected a view of the whole office network.
The defences are a mix of technology and procedure. On the technology side, we moved the group's domain to enforced DMARC (p=reject), with SPF and DKIM aligned for every legitimate sender, so mail pretending to be from the company is rejected. MTA-STS forces encrypted delivery between mail servers, and TLS reporting shows where it fails. For access, we replaced the broad VPN with identity-aware zero-trust access: each application checks who the user is and the health of their device on every connection. Staff who approve payments use phishing-resistant passkeys or hardware security keys, which cannot be tricked by a fake login page. The few systems that cannot sit behind the proxy are reached through WireGuard with per-user keys.
The rollout took ten weeks and ran in the order of risk. DMARC moved from monitoring to quarantine to reject over six weeks, after reports showed every legitimate sender, including a forgotten marketing platform, was aligned. Passkeys came next, starting with the finance team and executives. Applications moved behind the access proxy one at a time, the VPN was narrowed to named systems, and finally closed. Laptops and phones were enrolled in device management with disk encryption before they received access.
We tested the way an attacker works. A controlled phishing exercise sent look-alike-domain mail and fake payment-change requests to staff; the mail gateway caught most, and the rest were reported by the staff who saw them. A fake login page was shown to users with passkeys to confirm it could not capture a usable credential. The wire-change procedure, a call to a number already on file, was rehearsed with a mock closing so that staff knew they were allowed to delay a payment to verify it.
Inbound mail is analyzed for look-alike domains, first-time senders and reply-to tricks, and the managed service watches mail and sign-in logs around the clock. The result is spoofing of the group's domain blocked at the mail gateway, staff access that depends on who and what is asking rather than where they sit, and a payment-change process that does not trust an email alone.
What our team delivered
- Identity-aware, zero-trust access: each application reachable only after the user and the device pass checks, with no flat VPN to the office
- WireGuard-based private access for the few internal systems that cannot be published through an identity proxy
- Phishing-resistant sign-in with passkeys or hardware security keys for staff who handle money
- SPF, DKIM and DMARC at enforcement (p=reject), MTA-STS and TLS reporting to stop domain spoofing
- Inbound mail analysis for look-alike domains, new-sender payment requests and reply-to tricks
- A written wire-change procedure: any change to payment instructions is confirmed by a call to a known number
- Device management and encrypted laptops and phones
Result
Spoofing of the group’s domain blocked at the mail gateway, staff access that depends on who and what is asking rather than where they sit, and a payment-change process that does not trust an email alone. In the modeled ten weeks, the first two went to mail authentication (monitoring-only DMARC, then quarantine, then reject once legitimate senders were inventoried), the middle weeks to identity-aware access and passkey enrollment for finance and executive staff, and the last to the wire-change procedure and a phishing exercise. The measurable outcomes were a domain that could no longer be spoofed, no shared remote-access passwords, and a call-back record for every changed payment instruction.
Access to one app, not to the network
Zero trust network access replaces the all-or-nothing VPN. The identity provider proves who you are, the device agent proves the laptop is healthy, the policy engine decides, and the enforcement point opens a tunnel to that single application and nothing else.
Every sign-in, verified
Staff sign in once, but behind the scenes the device, the identity, a phone approval and your access policy are all checked before any app opens, and strangers are turned away.
Mail that keeps flowing
Incoming mail is authenticated and scanned before it reaches anyone, mailboxes are copied across three regions so a server failure goes unnoticed, and outgoing mail leaves signed and encrypted.
DMARC: from watching to rejecting
Share of mail claiming the domain that passes DMARC (SPF or DKIM aligned), week by week. In the monitoring phase (p=none) reports reveal forgotten senders; each one gets SPF and DKIM fixed. Quarantine sends failures to spam, reject refuses them at the receiving server. Illustrative figures.
Facing something similar?
Tell us about your environment. We will tell you plainly what we would do and what it would take.