Authors:
Jackie Scott
;
Yair Levy
;
Wei Li
and
Ajoy Kumar
Affiliation:
College of Computing and Engineering, Nova Southeastern University, 3301 College Avenue, Fort Lauderdale, Florida, 33314, U.S.A.
Keyword(s):
Phishing, Spear-Phishing, Security Education, Training, and Awareness (SETA), Business Email Compromise (BEC), Red Team, Phishing Campaigns, Phishing Training.
Abstract:
Although there have been numerous significant technological advancements in the last several decades, there continues to be a real threat as it pertains to social engineering, especially phishing, spear-phishing, and Business Email Compromise (BEC). While the technologies to protect end-users have gotten better, the ‘human factor’ in cybersecurity is the main penetration surface. These three phishing methods are used by attackers to infiltrate corporate networks and manipulate end-users, especially through business email. Our research study was aimed at assessing several phishing mitigation methods, including phishing training and campaign methods, as well as any human characteristics that enable a successful cyberattack through business email. Following expert panel validation for the experimental procedure, a pilot study with 172 users and then a full study with 552 users were conducted to collect six actual end-users’ negative response actions to phishing campaigns conducted with
traditional Commercial-Off-The-Shelf (COTS) product (KnowBe4) and a red team. Users were randomly assigned to three groups: no training; traditional training; and longitudinal customized training with 1,104 data points collected. While the phishing method was significant, our results indicate that current training methods appear to provide little to no added value vs. no training at all.
(More)