PHISHY - A Serious Game to Train Enterprise Users on Phishing Awareness

Cj, Gokul; Pandit, Sankalp; Vaddepalli, Sukanya; Tupsamudre, Harshal; Banahatti, Vijayanand; Lodha, Sachin

doi:10.1145/3270316.3273042

Cited by 30 publications

(10 citation statements)

References 26 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Studies have shown that serious games have the potential to be more effective in education than textbooks [20]. Serious games have been used for training in academia [30,31,32], teaching cultural heritage [21,22], training social interactions [23], medical education [24,25] and healthcare [27], manufacturing education [26], language learning [28], cybersecurity awareness [14,15,16,17,18], and various other fields. A study on the effectiveness of serious games [29] concluded with a fair amount of evidence to suggest that serious games have positive effects on learning.…”

Section: Background and Related Workmentioning

confidence: 99%

“…Training is a proactive method to educate users, thereby enabling them to make decisions on their own [49]. The traditional methods of training using documents, articles, and slideshows are often regarded as nonengaging and monotonous methods [16,18,47]. Defined as "games with a purpose", serious games [15] tackle this problem by providing education and engagement.…”

Section: Introductionmentioning

confidence: 99%

“…Defined as "games with a purpose", serious games [15] tackle this problem by providing education and engagement. Owing to the positive results shown by serious games [14,16,18], the Cybersecurity and Privacy Research Group (CPRG) of our organization took a proactive approach to provide a simulated phishing email awareness training to the employees and study its effects on the participants. The research questions we address are: RQ1) Can a simulated emailbased awareness game for enterprise employees show positive effects on their email judgment?…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

PickMail: A Serious Game for Email Phishing Awareness Training

Jayakrishnan¹,

Banahatti²,

Lodha³

2022

Proceedings 2022 Symposium on Usable Security

View full text Add to dashboard Cite

Phishing threats are on the rise, especially through Business Email Compromise (BEC). Despite having several tools for phishing email detection, the attacks are becoming smarter and personal, targeting individuals to gain access to personal and organizational information. Game-based cybersecurity training methods are found to have positive results in educating users. Along this line, we introduce PickMail, an anti-phishing awareness game that simulates typical real-life email scenarios to train an organization's employees. In PickMail, we train participants to judge the legitimacy of an email by inspecting its various parts, such as the sender's email domain, hyperlinks, attachments, and forms. The game also records participants' decision-making steps that lead to their final judgment. Our study with 478 participants shows how the serious game-based training helped the participants make better judgments on emails, with the correctness in identifying email legitimacy reaching 92.62%. The study also provided us with insights that could help develop better training methods and user interfaces.Usable Security and Privacy (USEC) Symposium 2022

show abstract

Section: Background and Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

PickMail: A Serious Game for Email Phishing Awareness Training

Jayakrishnan¹,

Banahatti²,

Lodha³

2022

Proceedings 2022 Symposium on Usable Security

View full text Add to dashboard Cite

show abstract

“…Intentional data leaks caused by internal workers are much more dangerous and much harder to counteract against industrial systems due to the fact that awareness and knowledge of the production process is a key element of disguising the source of the threat. The methods and causes that most often threaten the security of data and industrial networks through unintentional human fault include phishing [73][74][75], cyber-physical attacks [76][77][78], low password strength and their duplication for private and corporate purposes [79]. This is why the cybersecurity trainings and rising awareness is one of the key aspects of eliminating the human component in risk sources [80].…”

Section: Human Componentmentioning

confidence: 99%

Security Challenges in Industry 4.0 PLC Systems

2021

View full text Add to dashboard Cite

The concept of the fourth industrial revolution assumes the integration of people and digitally controlled machines with the Internet and information technologies. At the end of 2015, more than 20 billion machines and devices were connected to the Internet, with an expected growth to half a trillion by 2030. The most important raw material for this digital revolution is data, which when properly stored, analyzed and secured, constitute the basis for the development of any business. In times of rapid industrial development, automation of production processes and systems integration via networks, the effective protection of the cyber-physical systems of a plant is particularly important. To minimize the risks associated with Internet access, one must define all the possible threats and determine their sources in the plant and block or minimize the possibility of sabotage or data loss. This article analyzes the security measures used in industrial systems. In particular, risk management and the study of the risk sources in terms of human, hardware and software aspects in networked PLC and SCADA systems are discussed. Methods of improving the architecture of industrial networks and their management are proposed in order to increase the level of security. Additionally, the safety of the communication protocols with PLCs in industrial control systems is discussed.

show abstract

“…Another similar approach involves designing programs that teach security content, but those programs are games. Games offer a great way to teach security concepts; those games are usually called Serious Games (CJ et al, 2018). One example of such games is the one developed by Kumaraguru et al (2010) called Anti-Phishing Phil.…”

Section: Programs/ Interactive Games Delivery Methodsmentioning

confidence: 99%

Qualities of Impactful Cyber Security Awareness Training

Labib¹

View full text Add to dashboard Cite

show abstract

PHISHY - A Serious Game to Train Enterprise Users on Phishing Awareness

Cited by 30 publications

References 26 publications

PickMail: A Serious Game for Email Phishing Awareness Training

PickMail: A Serious Game for Email Phishing Awareness Training

Security Challenges in Industry 4.0 PLC Systems

Qualities of Impactful Cyber Security Awareness Training

Contact Info

Product

Resources

About