Lessons from a real world evaluation of anti-phishing training

eCrime Researchers Summit, eCrime 2008

Volumn , Issue , 2008, Pages

  Kumaraguru, Ponnurangam ^a   Sheng, Steve ^a   Acquisti, Alessandro ^a   Cranor, Lorrie Faith ^a   Hong, Jason ^a  

^a CARNEGIE MELLON UNIVERSITY   (United States)

Author keywords

Design; Embedded training; Experimentation; Human factors; Real world studies; Security

Indexed keywords

EMBEDDED TRAINING; EXPERIMENTATION; HUMAN FACTORS; REAL WORLD STUDIES; SECURITY;

ELECTRONIC MAIL; HUMAN ENGINEERING; INFORMATION DISSEMINATION; PERSONNEL;

PERSONNEL TRAINING;

EID: 67249151917     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/ECRIME.2008.4696970     Document Type: Conference Paper

References (33)

1. Allen, M. 1993. Social engineering: A means to violate a computer system. Tech. rep., SANS Institute, 2006.
2. Anandpara, V., Dingman, A., Jakobsson, M., Liu, D., and Roinestad, H. 2007. Phishing IQ tests measure fear, not ability. Usable Security (USEC'07). http://usablesecurity.org/papers/anandpara.pdf .
3. Brewer, M. Research Design and Issues of Validity. In Handbook of Research Methods in Social and Personality Psychology, pages 3-16. Cambridge University Press, 2000.
4. Burt, R. S. 1987. Social contagion and innovation: Cohesion versus structural equivalence. The American Journal of Sociology, 92, 6, 1287-1335.
5. Clark, R. C., and Mayer, R. E. 2002. E-Learning and the science of instruction: proven guidelines for consumers and designers of multimedia learning. John Wiley & Sons, Inc., USA.
6. Dhamija, R., Tygar, J. D., and Hearst, M. 2006. Why phishing works. In Proceedings of the SIGCHI Conference on Human Factors in Computing Systems (Montréal, Québec, Canada, April 22-27, 2006). R. Grinter, T. Rodden, P. Aoki, E. Cutrell, R. Jeffries, and G. Olson, Eds. CHI '06. ACM Press, New York, NY, 581-590. DOI= http://doi.acm.org/10.1145/1124772.1124861.
7. Downs, J. S., Holbrook, M. B., and Cranor, L. F. 2006. Decision strategies and susceptibility to phishing. In Proceedings of the Second Symposium on Usable Privacy and Security (Pittsburgh, Pennsylvania, July 12-14, 2006). SOUPS '06, vol. 149. ACM Press, New York, NY, 79-90. DOI= http://doi.acm.org/10.1145/1143120.1143131.
8. eBay. Spoof Email Tutorial. Retrieved December 30, 2006. http://pages.ebay.com/education/spooftutorial/
9. Federal Trade Commission. An E-Card for You game. Retrieved December 30, 2006. http://www.ftc.gov/bcp/conline/ecards/phishing/index.html.
10. Federal Trade Commission. Phishing Alerts. Retrieved December 30, 2006. http://www.ftc.gov/bcp/conline/pubs/alerts/phishingalrt.htm
11. Ferguson, A. J. 2005. Fostering E-Mail Security Awareness: The West Point Carronade. EDUCASE Quarterly, 1. Retrieved March 22, 2006, http://www.educause. edu/ir/library/pdf/eqm0517.pdf.
12. Hiner, J. 2002. Change your company's culture to combat social engineering attacks. Retrieved Nov 3, 2006. http://articles.techrepublic.com. com/5100-1035-11-1047991.html.
13. ISO. 2005. ISO/IEC 27001:2005 - Information technology - Security techniques - Information security management Systems - Requirements. Tech. rep., International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC), October 2005.
14. Jackson, C., Simon, D., Tan, D., and Barth, A. 2007. An evaluation of extended validation and picture-in-picture phishing attacks. In Usable Security (USEC'07). http://usablesecurity.org/papers/jackson.pdf.
15. Jagatic, T., Johnson, N., Jakobsson, M., and Menczer, F. Social phishing. 2007. Communications of the ACM 50, 10, 94-100. Retrieved March 7, 2006, http://www.indiana.edu/phishing/social-network-experiment/phishing-preprint.pdf.
16. Jakobsson, M. and Ratkiewicz, J. 2006. Designing ethical phishing experiments: a study of (ROT13) rOnl query features. In Proceedings of the 15th international Conference on World Wide Web (Edinburgh, Scotland, May 23-26, 2006). WWW '06. ACM Press, New York, NY, 513-522. DOI= http://doi.acm.org/10. 1145/1135777.1135853
17. Karlof, C., Tygar, J., and Wagner, D. 2008. A user study design for comparing the security of registration protocols. Usability, Psychology, and Security (UPSEC).
18. Kumaraguru, P., Acquisti, A., and Cranor, L. 2006. Trust modeling for online transactions: A phishing scenario. In Privacy Security Trust. http://www.cs.cmu.edu/onguru/pk-aa-lc-pst-2006.pdf.
19. Kumaraguru, P., Sheng, S., Acquisti, A., Cranor, L. F., and Hong, J. 2007. Teaching johnny not to fall for phish. Tech. rep., Cranegie Mellon University. http://www.cylab.cmu.edu/files/cmucylab07003.pdf.
20. Kumaraguru, P., Y. Rhee, A. Acquisti, L. Cranor, J. Hong, and E. Nunge. 2007. In Proceedings of CHI 2007. Protecting People from Phishing: The Design and Evaluation of an Embedded Training Email System.
21. Kumaraguru, P., Rhee, Y., Sheng, S., Hasan, S., Acquisti, A., Cranor, L. F., and Hong, J. 2007. Getting users to pay attention to anti-phishing education: Evaluation of retention and transfer. e-Crime Researchers Summit, Anti-Phishing Working Group.
22. Kumaraguru, P., Sheng, S., Acquisti, A., Cranor, L. F., and Hong, J. 2008. Under submission.
23. Mail Frontier. Phishing IQ. Retrieved Sept 20, 2006. http://survey. mailfrontier.com/survey/quiztest.html.
24. Microsoft. Consumer Awareness Page on Phishing. Retrieved September 10, 2006. http://www.microsoft.com/athome/security/email/phishing.mspx.
25. NIST. 1998. Information technology security training requirements: A role- and performance-based model (800-16). Tech. rep., National Institute of Standards and Technology.
26. NIST. 2004. NIST special publication 800-12: An introduction to computer security - the NIST handbook. Tech. rep., National Institute of Standards and Technology.
27. New York State Office of Cyber Security & Critical Infrastructure Coordination. 2005. Gone phishing⋯ a briefing on the anti-phishing exercise initiative for New York state government. Aggregate Exercise Results for public release.
28. Robila, S. A., J. James and W. Ragucci. 2006. Don't be a phish: steps in user education. ITICSE '06: Proceedings of the 11th annual SIGCSE conference on Innovation and technology in computer science education. pp 237-241. New York, NY, USA.
29. Salden, R., Aleven, V., Renkl, A., and Schwonke, R. 2008. Worked examples and tutored problem solving: redundant or synergistic forms of support? In Annual Meeting of the Cognitive Science Society. In press.
30. Schechter, S. E., Dhamija, R., Ozment, A., and Fischer, I. 2007. The emperor's new security indicators. In SP '07: Proceedings of the 2007 IEEE Symposium on Security and Privacy (Washington, DC, USA), IEEE Computer Society, pp. 51-65.
31. Sheng, S., Magnien, B., Kumaraguru, P., Acquisti, A., Cranor, L. F., Hong, J., and Nunge, E. 2007. Anti-phishing Phil: The design and evaluation of a game that teaches people not to fall for phish. In SOUPS '07: Proceedings of the 3rd symposium on Usable privacy and security (New York, NY, USA, March 2007), ACM, pp. 88-99. Symposium On Usable Privacy and Security. DOI=http://doi.acm.org/10.1145/1280680.1280692.
32. Srikwan, S., and Jakobsson, M. Using cartoons to teach security. Tech. rep., DIMACS, 2007. Retrieved April 1, 2008, http://www.informatics.indiana.edu/ markus/documents/security-education.pdf.
33. Timko, D. 2008. The social engineering threat. Information Systems Security Association Journal.