Teaching johnny not to fall for phish

ACM Transactions on Internet Technology

Volumn 10, Issue 2, 2010, Pages

  Kumaraguru, Ponnurangam ^a   Sheng, Steve ^a   Acquisti, Alessandro ^a   Cranor, Lorrie Faith ^a   Hong, Jason ^a  

^a CARNEGIE MELLON UNIVERSITY   (United States)

Author keywords

Email; Embedded training; Instructional principles; Learning science; Phishing; Situated learning; Usable privacy and security

Indexed keywords

INSTRUCTIONAL PRINCIPLES; LEARNING SCIENCE; PHISHING; SITUATED LEARNING; USABLE PRIVACY;

EDUCATION; ELECTRONIC MAIL; WORLD WIDE WEB;

SECURITY OF DATA;

EID: 77953569639     PISSN: 15335399     EISSN: 15576051     Source Type: Journal    
DOI: 10.1145/1754393.1754396     Document Type: Article

References (82)

1. ABU-NIMEH, S., NAPPA, D., WANG, X., AND NAIR, S. 2007. A comparison of machine learning techniques for phishing detection. e-Crime Researchers Summit, Anti-Phishing Working Group.
2. ACCOUNT GUARD. 2006. Account Guard. http://pages.ebay.com/ebay-toolbar/.
3. ADAMS, A. AND SASSE, M. A. 1999. Users are not the enemy. Comm. ACM 42, 12, 40-46. DOI=http://doi.acm.org/10.1145/322796.322806.
4. ALEVEN, V. AND KOEDINGER, K. R. 2002. An effective metacognitive strategy: learning by doing and explaining with a computer-based cognitive tutor. Cogn. Sci. 26, 2, 147-179.
5. ANANDPARA, V., DINGMAN, A., JAKOBSSON, M., LIU, D., AND ROINESTAD, H. 2007. Phishing IQ tests measure fear, not ability. Usable Security Workshop (USEC'07). http://usablesecurity.org/papers/anandpara.pdf.
6. ANDERSON, J. R. 1993. Rules of the Mind. Lawrence Erlbaum Associates, Inc.
7. ANDERSON, J. R., CORBETT, A. T., KOEDINGER, K. R., AND PELLETIER, R. 1995. Cognitive tutors: Lessons learned. J. Learn. Sci. 4, 2, 167-207.
8. ANDERSON, J. R. AND SIMON, H. A. 1996. Situated learning and education. Educ. Resear. 25, 5-11.
9. ANTI-PHISHING WORKING GROUP. 2007. Anti-Phishing Working Group. http://www.antiphishing.org/.
10. BAHRICK, H. P. 1979. Maintenance of knowledge: Questions about memory we forgot to ask. J. Exper. Psych. 108, 3, 296-308.
11. BAKER, R., HABGOOD, J., AND AINSWORTH, S. E. 2007. Modeling the acquistion of fluent skill in educational action games. Proceedings of the Conference on User Modeling, 17-26.
12. BARNETT, S. M. AND CECI, S. J. 2002. When and where do we apply what we learn? a taxonomy for far transfer. Psych. Bull. 128, 612-637.
13. BRANSFORD, J. D. AND SCHWARTZ, D. L. 2001. Rethinking transfer: A simple proposal with multiple implications. In Review of Research in Education, A. Iran-Nejad and P. D. Pearson., Eds. Vol. 24, American Educational Research Association (AERA), Washington, DC, 61-100.
14. BURMESTER, G. M., STOTTLER, D., AND HART, J. L. 2005. Embedded training intelligent tutoring systems (ITS) for the future combat systems (FCS) command and control (C2) vehicle. Tech. rep., Defense Technical Information Center. http://www.stottlerhenke.com/papers/IITSEC-02-ITSFCS.pdf.
15. CHANDRASEKARAN, M., NARAYANAN, K., AND UPADHYAYA, S. 2006. Phishing email detection based on structural properties. Proceedings of the NYS Cyber Security Conference.
16. CLARK, R. C. 1989. Developing Technical Training: A Structured Approach for the Development of Classroom and Computer-Based Instructional Materials. Addison Wesley Publishing Company.
17. CLARK, R. C. AND MAYER, R. E. 2002. E-Learning and the Science of Instruction: Proven Guidelines for Consumers and Designers of Multimedia Learning. John Wiley & Sons, Inc.
18. COMMITTEE ON DEVELOPMENTS IN THE SCIENCE OF LEARNING AND NATIONAL RESEARCH COUNCIL. 2000. How People Learn: Bridging Research and Practice. National Academies Press.
19. CORBETT, A. T. AND ANDERSON, J. R. 2001. Locus of feedback control in computer-based tutoring: impact on learning rate, achievement and attitudes. In Proceedings of the SIGCHI Conference on Human Factors in Computing Systems (CHI'01). ACM Press, New York, NY, 245-252.
20. CORDOVA, D. I. AND LEPPER, M. R. 1996. Intrinsic motivation and the process of learning: Beneficial effects of contextualization, personalization, and choice. J. Educ. Psych. 88, 4, 715-730.
21. CRANOR, L. F. 2008. A framework for reasoning about the human in the loop. In Proceedings of the Conference on Usability, Psychology and Security.
22. CRANOR, L. F. AND GARFINKEL, S. Aug, 2005. Security and Usability: Designing Secure Systems that People Can Use. O'Reilly, Sebastopol, CA.
23. DHAMIJA, R. AND TYGAR, J. 2005. The battle against phishing: Dynamic security skins. In Proceedings of the Symposium on Usable Privacy and Security (SOUPS'05). ACM Press, New York, NY, 77-88.
24. EBAY. 2006. Spoof email tutorial. http://pages.ebay.com/education/ spooftutorial.
25. EBERTS, R. E. 1997. Handbook of Human-Computer Interaction. Elsevier Science, 825-847.
26. EGELMAN, S., CRANOR, L. F., AND HONG, J. 2007. You've been warned: An empirical study of the effectiveness of Web browser phishing warnings. In Proceedings of the SIGCHI Conference on Human Factors in Computing Systems (CHI'08).
27. EMIGH, A. 2005. Online identity theft: Phishing technology, chokepoints and countermeasures. Tech. rep., Radix Labs. October. http://www.antiphishing. org/Phishing-dhs-report.pdf.
28. EVERS, J. 2006. User education is pointless. http://news.com.com/2100- 7350-3-6125213.html.
29. FEDERAL TRADE COMMISSION. 2006a. An e-card for you game. http://www.ftc.gov/bcp/conline/ecards/phishing/index.html.
30. FEDERAL TRADE COMMISSION. 2006b. How not to get hooked by a phishing scam. Consumer alert news. http://www.ftc.gov/bcp/edu/pubs/consumer/alerts/ alt127.htm.
31. FERGUSON, A. J. 2005. Fostering e-mail security awareness: The west point carronade. EDUCASE Quart. 1. http://www.educause.edu/ir/library/pdf/eqm0517. pdf.
32. FETTE, I., SADEH, N., AND TOMASIC, A. 2006. Learning to detect phishing emails. In Proceedings of the 16th International Conference on World Wide Web.
33. FLORENCIO, D. AND HERLEY, C. 2005. Stopping a phishing attack, even when the victims ignore warnings. Tech. rep., Microsoft.
34. FONG, G. T. AND NISBETT, R. E. 1991. Immediate and delayed transfer of training effects in statistical reasoning. J. Exper. Psych. 120, 34-45.
35. GAGNE, R. M., FOSTER, H., AND CROWLEY, M. E. 1948. The measurement of transfer of training. Psych. Bull. 45, 2, 97-130.
36. GORDON, L. A., LOEB, M. P., LUCYSHYN, W., AND RICHARDSON, R. 2006. CSI/FBI computer crime and security survey. Report, Computer Security Institute.
37. GORLING, S. 2006. The myth of user education. In Proceedings of the 16th Virus Bulletin International Conference.
38. HIGHT, S. D. 2005. The importance of a security, education, training and awareness program. http://www.infosecwriters.com/text-resources/pdf/SETA-SHight. pdf.
39. JACKSON, C., SIMON, D., TAN, D., AND BARTH, A. 2007. An evaluation of extended validation and picture-in-picture phishing attacks. In Proceedings of the Usable Security Workshop (USEC'07). http://usablesecurity.org/papers/ jackson.pdf.
40. JAGATIC, T., JOHNSON, N., JAKOBSSON, M., AND MENCZER, F. 2007. Social phishing. Comm. ACM 50, 10, 94-100.
41. JAKOBSSON, M. 2007. The human factor in phishing. In Privacy & Security of Consumer Information. http://www.informatics.indiana.edu/markus/ papers/aci.pdf.
42. JAKOBSSON, M. AND MYERS, S., Eds. 2006. Phishing and Countermeasures: Understanding the Increasing Problem of Electronic Identity Theft. Wiley-Interscience.
43. JAMES, L. 2005. Phishing Exposed. Syngress Publishing, Canada.
44. JOHNSON, B. R. AND KOEDINGER, K. R. 2002. Comparing instructional strategies for integrating conceptual and procedural knowledge. In Proceedings of the Annual Meeting of the North American Chapter of the International Group for the Psychology of Mathematics Education. Vol. 1-4. 969-978.
45. KIRKLEY, J. R. AND ET AL. 2003. Problem-based embedded training: An instructional methodology for embedded training using mixed and virtual reality technologies. In Proceedings of the Interservice/Industry Training, Simulation, and Education Conference (I/ITSEC). http://www.iforces.org/downloads/problem- based.pdf.
46. KOEDINGER, K. R. 2002. Toward evidence for instruction design principles: Examples from cognitive tutor math 6. Proocedings of the Annual Meeting of the Norh American Chapter of the International Group for the Psychology of Mathematics Education 1-4.
47. KUMARAGURU, P., RHEE, Y., ACQUISTI, A., CRANOR, L. F., HONG, J., AND NUNGE, E. 2007a. Protecting people from phishing: the design and evaluation of an embedded training email system. In Proceedings of the SIGCHI Conference on Human Factors in Computing Systems (CHI'07). ACM Press, New York, NY, 905-914.
48. KUMARAGURU, P., RHEE, Y., SHENG, S., HASAN, S., ACQUISTI, A., CRANOR, L. F., AND HONG, J. 2007b. Getting users to pay attention to anti-phishing education: Evaluation of retention and transfer. e-Crime Researchers Summit, Anti-Phishing Working Group.
49. LININGER, R. AND VINES, R. D. 2005. Phishing: Cutting the Identity Theft Line. IN. John Wiley and Sons.
50. MACMILLAN, N. A. AND CREELMAN, C. D. 2004. Detection Theory: A User's Guide. Lawrence Erlbaum.
51. MAIL FRONTIER. 2006. Mailfrontier phishing IQ test. http://survey. mailfrontier.com/survey/quiztest.html.
52. MANDL, H. AND LEVIN, J. R. 1989. Knowledge Acquisition from Text and Pictures. North-Holland.
53. MATHAN, S. A. AND KOEDINGER, K. R. 2003. Artificial Intelligence in Education: Shaping the Future of Learning Through Intelligent Technolgis. IOS Press, 13-20.
54. MATHAN, S. A. AND KOEDINGER, K. R. 2005. Fostering the intelligent novice: Learning from errors with metacognitive tutoring. Educ. Psych. 40, 4, 257-265.
55. MAYER, R. E. 2001. Multimedia Learning. Cambridge University Press, Cambidge, UK.
56. MAYER, R. E. AND ANDERSON, R. B. 1992. The instructive animation: Helping students build connections between words and pictures in multimedia learning. J. Educ. Psych. 84, 4, 444-452.
57. MCBRIDE, C. M., EMMONS, K. M., AND LIPKUS, I. M. 2003. Understanding the potential of teachable moments: the case of smoking cessation. Health Educ. Resear. 18, 2, 156-170.
58. MERRIENBOER, J. V., DE CROOCK, M., AND JELSMA, O. 1997. The transfer paradox: Effects of contextual interference on retention and transfer performance of a complex cognitive skill. Percept. Motor Skills 84, 784-786.
59. MICROSOFT CORPORATION. 2006. Consumer awareness page on phishing. http://www.microsoft.com/athome/security/email/phishing.mspx.
60. MILLER, R. C. AND WU, M. 2005. Fighting phishing at the user interface. In L. Cranor and S. Garfinkel Eds. Security and Usability: Designing Secure Systems that People Can Use. O'Reilly.
61. MORENO, R. AND MAYER, R. E. 1999. Cognitive principles of multimedia learning: The role of modality and contiguity. J. Educ. Psych. 91, 358-368.
62. MYSECURECYBERSPACE. 2007. Uniform resource locator (URL). http://www.mysecurecyberspace.com/encyclopedia/index/uniform-resource-locator- url-.html.
63. NETCRAFT. 2006. Netcraf. http://toolbar.netcraft.com/.
64. NEW YORK STATE OFFICE OF CYBER SECURITY & CRITICAL INFRASTRUCTURE COORDINATION. 2005. Gone phishing⋯ a briefing on the anti-phishing exercise initiative for New York State government. Aggregate Exercise Results for public release.
65. NIELSEN, J. 2004. User education is not the answer to security problems. http://www.useit.com/alertbox/20041025.html.
66. ROBILA, S. A. AND RAGUCCI, J. W. 2006. Don't be a phish: steps in user education. In Proceedings of the 11th Annual SIGCSE Conference on Innovation and Technology in Computer Science Education (ITICSE'06). ACM Press, New York, NY, 237-241. DOI=http://doi.acm.org/10.1145/1140124.1140187. (Pubitemid 47344419)
67. RUBIN, D. C. AND WENZEL, A. E. 1996. One hundred years of forgetting: A quantitative description of retention. Psych. Rev. 103, 4, 734-760.
68. SALKIND, N. J. 2006. Encyclopedia of Measurement and Statistics. Sage Publications.
69. SCHMIDT, R. A. AND BJORK, R. A. 1992. New conceptualizations of practice: Common principles in three paradigms suggest new concepts for training. Psych. Sci. 3, 4, 207-217.
70. SCHNEIER, B. 2000. Semantic attacks: The third wave of network attacks. Crypto-Gram Newsletter. http://www.schneier.com/crypto-gram-0010.html#1.
71. SCHWARTZ, D. L. AND BRANSFORD, J. D. 1998. A time for telling. Cogn. Instruc., 475-522.
72. SENDER POLICY FRAMEWORK. 2006. Sender Policy Framework. http://www.openspf.org/.
73. SHENG, S., MAGNIEN, B., KUMARAGURU, P., ACQUISTI, A., CRANOR, L. F., HONG, J., AND NUNGE, E. 2007. Anti-phishing phil: The design and evaluation of a game that teaches people not to fall for phish. Proceedings of the Symposium on Usable Privacy and Security.
74. SHENG, S., WARDMAN, B., WARNER, G., CRANOR, L., HONG, J., AND ZHANG, C. 2009. An empirical analysis of phishing blacklists. Proceedings of the 6th Conference on Email and Anti-Spam.
75. SINGLEY, M. AND ANDERSON, J. R. 1989. The Transfer of Cognitive Skill. Harvard University Press.
76. SPOOFGUARD. 2006. Spoofguard. http://crypto.stanford.edu/SpoofGuard/.
77. SPOOFSTICK. 2006. Spoofstick. http://www.spoofstick.com/.
78. WHITTEN, A. 2004. Making security usable. Ph.D. thesis, Carnegie Mellon University.
79. WU, M., MILLER, R. C., AND GARFINKEL, S. L. 2006. Do security toolbars actually prevent phishing attacks? In Proceedings of the Conference on Human Factors in Computing Systems (CHI), 601-610.
80. YAHOO. 2007. DomainKeys: Proving and Protecting Email Sender Identity. http://antispam.yahoo.com/domainkeys.
81. YE, Z. E. AND SMITH, S. 2002. Trusted paths for browsers. In Proceedings of the 11th USENIX Security Symposium. USENIX Association, Berkeley, CA, 263-279.
82. ZHANG, Y., EGELMAN, S., CRANOR, L., AND HONG, J. 2007. Phinding phish: Evaluating anti-phishing tools. In Proceedings of the 14th Annual Network and Distributed System Security Symposium. http://lorrie.cranor.org/pubs/ndss-phish- tools-final.pdf.