User Context: An Explanatory Variable in Phishing Susceptibility

Abstract

Abstract-Extensive research has been performed to examine the effectiveness of phishing defenses, but much of this research was performed in laboratory settings. In contrast, this work presents 4.5 years of workplace-situated, embedded phishing email training exercise data, focusing on the last three phishing exercises with participant feedback. The sample was an operating unit consisting of approximately 70 staff members within a U.S. government research institution. A multiple methods assessment approach revealed that the individual's work context is the lens through which email cues are interpreted. Not only do clickers and non-clickers attend to different cues, they interpret the same cues differently depending on the alignment of the user's work context and the premise of the phishing email. Clickers were concerned over consequences arising from not clicking, such as failing to be responsive. In contrast, non-clickers were concerned with consequences from clicking, such as downloading malware. This finding firmly identifies the alignment of user context and the phishing attack premise as a significant explanatory factor in phishing susceptibility. We present additional findings that have actionable operational security implications. The long-term, embedded and ecologically valid conditions surrounding these phishing exercises provided the crucial elements necessary for these findings to surface and be confirmed.

Experimental Investigation of Demographic Factors Related to Phishing Susceptibility

“…There were more clickers on the IT help desk email than the other two emails. This result may suggest that university employees pay more attention to emails related to their work context, which is consistent with findings from Greene et al [5]. The financial email fooled the smallest proportion of users, which may suggest that people are more alert to the emails that come from an unfamiliar bank that they were not enrolled.…”

“…Jagatic et al [9] suggest that a sender address from the university domain lowers students' guard. Greene et al [5] argue that the alignment of user context and the phishing attack premise is a significant factor in phishing susceptibility. Vishwanath et al [14] found the level of attention to urgency cues or to email subject lines significantly affects clicking response to phishing emails; however, levels of attention to grammar or spelling were significantly less likely to affect users being phished.…”

“…Will the content of phishing emails (source of message, visual cues) impact the likelihood of responding to the exploit? Previous research suggests that certain characteristics of a phishing email may affect clicking behavior (e.g., [5]). We focus on the type or source (IT/tech support, package delivery, credit card warning) that presents different message content or context.…”

“…A survey was sent after the experiment to analyze some additional demographic factors such as computer usage time and antiphishing training experience. Another recent example is a study by Greene et al [5], who launched three phishing exercises (Mar, Aug, Dec) targeting approximately 70 staff at the National Institute of Standards and Technology. The purpose was to study the reasons why email users were clicking or not clicking on phishing links and attachments.…”

A Phish Scale: Rating Human Phishing Message Detection Difficulty

“…Past work [14] has shown that click rates will vary based on the contextual relevance of the phish, with highly contextually relevant phish resulting in extreme spikes in click rates-despite years of phishing awareness training. Furthermore, attackers continue to refine and vary phishing attack premises.…”