Phish Derby: Shoring the Human Shield Through Gamified Phishing Attacks

Abstract

To better understand employees’ reporting behaviors in relation to phishing emails, we gamified the phishing security awareness training process by creating and conducting a month-long “Phish Derby” competition at a large university in the U.S. The university’s Information Security Office challenged employees to prove they could detect phishing emails as part of the simulated phishing program currently in place. Employees volunteered to compete for prizes during this special event and were instructed to report suspicious emails as potential phishing attacks. Prior to the beginning of the competition, we collected demographics and data related to the concepts central to two theoretical foundations: the Big Five personality traits and goal orientation theory. We found several notable relationships between demographic variables and Phish Derby performance, which was operationalized from the number of phishing attacks reported and employee report speed. Several key findings emerged, including past performance on simulated phishing campaigns positively predicted Phish Derby performance; older participants performed better than their younger colleagues, but more educated participants performed poorer; and individuals who used a mix of PCs and Macs at work performed worse than those using a single platform. We also found that two of the Big Five personality dimensions, extraversion and agreeableness, were both associated with poorer performance in phishing detection and reporting. Likewise, individuals who were driven to perform well in the Phish Derby because they desired to learn from the experience (i.e., learning goal orientation) performed at a lower level than those driven by other goals. Interestingly, self-reported levels of computer skill and the perceived ability to detect phishing messages failed to exhibit a significant relationship with Phish Derby performance. We discuss these findings and describe how focusing on motivating the good in employee cyber behaviors is a necessary yet too often overlooked component in organizations whose training cyber cultures are rooted in employee click rates alone.

Gamification of Cybersecurity Awareness for Non-IT Professionals: A Systematic Literature Review

“…Positive behavior changes, as a measurable outcome associated with game elements, are supported by the studies of [16] and [47]. In their study, [47] explored the impact of gamification elements, including Points, Competition, Alerts, and Feedback, in the Phish Derby experiment.…”

“…Positive behavior changes, as a measurable outcome associated with game elements, are supported by the studies of [16] and [47]. In their study, [47] explored the impact of gamification elements, including Points, Competition, Alerts, and Feedback, in the Phish Derby experiment. The Phish Derby experiment involved gamifying phishing security awareness training to understand employees' reporting behaviors regarding phishing emails.…”

“…The results showed an average improvement of 51.4% in security awareness, suggesting that gamification actively engaged employees and contributed to increased security awareness. Study [47] emphasized the positive impact of gamification in phishing awareness exercises, particularly with the Phish Derby. Participants enjoyed the gamified experience, highlighting that the focus on positive To enhance information security awareness by increasing user motivation and reducing learning barriers.…”

“…In summary, gamified elements consistently yield measurable results, such as increased knowledge, improved engagement, and behavior changes, effectively aligning with specific learning goals in cybersecurity. These include enhanced cybersecurity understand ing and awareness [6], [26], demonstrated by improved phishing threat recognition [47] and positive changes in employee behavior related to cybersecurity practices [6], as evidenced by improved password selection [16].…”

Application of intervention mapping in cybersecurity education design

“…Maladaptive cybersecurity behaviors (i.e., impulsive clicking) have been identified as a major threat to both individual and organizational security (Canham et al, 2022). Therefore, the course focused on improving cognitive and behavioral factors such as self-efficacy, repeat clicking, and critical thinking in risk assessment to encourage learning.…”