Using Phishing for User Email Security Awareness

Abstract

User security education and training is one of the most important aspects of an organizations security posture. Using security exercises to reinforce this aspect is frequently done by education and industry alike; however these exercises usually enlist willing participants. We have taken the concept of using an exercise and modified it somewhat to evaluate a users propensity to respond to email phishing attacks.

A Large-Scale Study of the Time Required to Compromise a Computer System

“…One reason behind this could be that the increased awareness is not permanent. In fact, previous research has shown that the effect might be rather temporary [40]. 4) Computer users seldom apply software security updates.…”

Students' Cybersecurity Awareness at a Private Tertiary Educational Institution

“…The students surveyed in this research appeared to exhibit an analogous contradiction: concerned about phishing yet not managing to acquire the necessary knowledge. This confirms that knowledge alone is not enough, and that it needs to be combined with training, as in the phishing simulation exercise by Dodge and Ferguson (2006).…”

“…This was attributed to incorrect behaviour patterns regarding online security. The use of simulated phishing emails to generate user awareness was investigated by Dodge and Ferguson (2006). Their study intended to assess the awareness levels of students at the United States Military Academy in order to inform their awareness programme.…”

Empirical Benefits of Training to Phishing Susceptibility

“…In early studies, the focus of the studies focused on the simple effectiveness of phishing exercises. [8] In these early results, the authors constructed an infrastructure to execute a phishing exercise and achieved results indicating an average 40% susceptibility to phishing. These results were validate in a follow-on study [9] and further showed that exercises repeated over a short duration increased awareness and susceptibility reduced to under 5%.…”