Who falls for phish? A demographic analysis of phishing susceptibility and effectiveness of interventions

Conference on Human Factors in Computing Systems - Proceedings

Volumn 1, Issue , 2010, Pages 373-382

  Sheng, Steve ^a   Holbrook, Mandy ^a   Kumaraguru, Ponnurangam ^b   Cranor, Lorrie Faith ^a   Downs, Julie ^a  

^a CARNEGIE MELLON UNIVERSITY   (United States)

^b INDRAPRASTHA INSTITUTE OF INFORMATION TECHNOLOGY   (India)

Author keywords

mechanical turk; phishing; roleplay; social engineering; survey; user behavior

Indexed keywords

AGE GROUPS; ANTI-PHISHING; DEMOGRAPHIC FACTORS; EDUCATIONAL MATERIALS; ONLINE SURVEYS; PHISHING; ROLE PLAY; SOCIAL ENGINEERING; SURVEY INSTRUMENTS; USER BEHAVIORS; WEB PAGE;

BEHAVIORAL RESEARCH; HUMAN ENGINEERING; POPULATION STATISTICS; SURVEYS;

SECURITY OF DATA;

EID: 77954007030     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1753326.1753383     Document Type: Conference Paper

References (31)

1. Blais, A. - R. and Weber, E. U. A domain-specific risk-taking (DOSPERT) scale for adult populations. Judgment and Decision Making 1, 1 (2006), 33-47 KW
2. Dhamija, R., J. D. Tygar. and M. Hearst. 2006. Why phishing works. In Proceedings of the SIGCHI Conference on Human Factors in Computing Systems (Montréal, Québec, Canada, April 22-27, 2006). R. Grinter, T. Rodden, P. Aoki, E. Cutrell, R. Jeffries, and G. Olson, Eds. CHI '06. ACM Press, New York, NY, 581-590.
3. Downs, J., M. Holbrook and L. Cranor. 2006. Decision strategies and susceptibility to phishing. In Proceedings of the Second Symposium on Usable Privacy and Security (Pittsburgh, Pennsylvania, July 12 - 14, 2006). SOUPS '06, vol. 149. ACM Press, New York, NY, 79-90.
4. Downs, J. S., Holbrook, M., and Cranor, L. F. 2007. Behavioral response to phishing risk. In Proceedings of the Anti-Phishing Working Groups 2nd Annual Ecrime Researchers Summit (Pittsburgh, Pennsylvania, October 04 - 05, 2007). eCrime '07, vol. 269. ACM, New York, NY, 37-44.
5. Downs, J., M. Holbrook, S. Sheng and L. Cranor. 2009. Are Your Participants Gaming the System? Screening Mechanical Turk Workers. CHI 2010.
6. Downs JS & Fischhoff B. (2009). Theories and models of adolescent decision making. In RJ DiClemente, JS Santelli & RA Crosby (Eds.) Adolescent Health: Understanding and Preventing Risk Behaviors, San Francisco, CA: Jossey-Bass.
7. eBay. Spoof Email Tutorial. Retrieved March 7, 2006, http://pages.ebay. com/education/spooftutorial/.
8. Evers, J. Security Expert: User education is pointless. Retrieved, Jan 13, 2007, http://news.com.com/2100-7350-3-6125213.html.
9. Federal Trade Commission. An E-Card for You game. Retrieved Nov 7, 2006, http://www.ftc.gov/bcp/conline/ ecards/phishing/index.html.
10. Ferguson, A. J. 2005. Fostering E-Mail Security Awareness: The West Point Carronade. EDUCASE Quarterly. 2005, 1. Retrieved March 22, 2006, http://www.educause.edu/ir/library/pdf/eqm0517.pdf.
11. Flynn J, Slovic, P, and Mertz, C. K 1994. Gender, Race, and Perception of Environmental Health Risks. Risk Analysis 14(6): 1101-1108.
12. Gartner Research. Gartner survey shows phishing attacks escalated in 2007. Press Release, 2007. http://www.gartner.com/it/page.jsp?id=565125
13. Gorling, S. 2006. The myth of user education. In Proceedings of the 16th Virus Bulletin International Conference.
14. Jagatic, T.,N. Johnson, M. Jakobsson and F. Menczer. Social Phishing. Communications of the ACM. Retrieved March 7, 2006.
15. Jakobsson, M. The Human Factor in Phishing. http://www.informatics. indiana.edu/markus/papers/aci.p df, 2006.
16. Kumaraguru, P., Sheng, S., Acquisti, A., Cranor, L. F., and Hong, J. 2007. Teaching Johnny not to fall for phish. Tech. rep., Carnegie Mellon University. http://www.cylab.cmu.edu/files/ cmucylab07003.pdf.
17. Kumaraguru, P., Y. Rhee, A. Acquisti, L. Cranor, J. Hong and E. Nunge. 2007. Protecting People from Phishing: The Design and Evaluation of an Embedded Training Email System. In Proceedings of the 2007 Computer Human Interaction, CHI 2007.
18. Kumaraguru, P. Cranshaw, J., Acquisti, A., Cranor, L., Hong, J., Blair, M. A., and Pham, T. School of Phish: A Real-World Evaluation of Anti-Phishing Training. In the Proceedings On Usable Privacy and Security, 2009.
19. Mackinnon, D. P and Dwyer, J . H. Estimating Mediated Effects in Prevention Studies. Eval Rev 17, 2 (1993), 144-158.
20. Mackinnon D.P, Fairchild, A.J and Fritz, M. S. Mediation analysis. Annual Review of Psychology 58, 1 (12 2006), 593-614.
21. MessageLabs. Messagelabs Intelligence May 2009. Report, May 2009. http://www.messagelabs.com/intelligence.aspx
22. Microsoft. Recognizing phishing scams and fraudulent emails. Retrieved Oct 15, 2006. http://www.microsoft.com/athome/security/email/phishing.mspx.
23. National Consumer League, Internet fraud tips: phishing. [url] http://www.fraud.org/tips/ internet/phishing.htm . Retrieved Jan 1, 2009.
24. New York State Office of Cyber Security & Critical Infrastructure Coordination. Gone Phishing. A Briefing on the Anti-Phishing Exercise Initiative for New York State Government. Aggregate Exercise Results for public release. 2005
25. OnGuardOnline, How Not To Get Hooked by a "Phishing" Scam. [url]: http://www.onguardonline. gov/topics/phishing.aspx. Retrieved Jan 1, 2009.
26. Preacher K.J and Hayers A.F. Asymptotic and resampling strategies for assessing and comparing indirect effects in multiple mediator models. Behavior research methods 40, 3 (Aug 2008), 879-91.
27. Reyna VF & Farley F. (2006). Risk and rationality in adolescent decision making: Implications for theory, practice, and public policy. Psychological Science in the Public Interest, 7, 1-44.
28. Schechter, S. E., Dhamija, R., Ozment, A., Fischer, I., 2007 The Emperor's New Security Indicators. IEEE Symposium on Security and Privacy, 20-23 May 2007.
29. Sheng, S., Magnien, B., Kumaraguru, P., Acquisti, A., Cranor, L. F., Hong, J., and Nunge, E. 2007. Anti- Phishing Phil: the design and evaluation of a game that teaches people not to fall for phish. In Proceedings of the 3rd Symposium on Usable Privacy and Security (Pittsburgh, Pennsylvania, July 18 - 20, 2007). SOUPS '07, vol. 229. ACM, New York, NY, 88-99.
30. Slovic, P 2000. The Perception of Risk, Sterling, VA: Earthscan Publications Ltd.
31. Wu, M., Miller, R. C., and Garfinkel, S. L. 2006. Do security toolbars actually prevent phishing attacks?. In Proceedings of the SIGCHI Conference on Human Factors in Computing Systems (Montréal, Québec, Canada, April 22 - 27, 2006). R. Grinter, T. Rodden, P. Aoki, E. Cutrell, R. Jeffries, and G. Olson, Eds. CHI '06. ACM Press, New York, NY, 601-610.