Adopting the CMU/APWG Anti-phishing Landing Page Idea for Germany

Abstract

Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works.Abstract-Phishing attacks still pose a significant problem and purely technical solutions cannot solve this problem. While research literature in general shows that educating users in security is hard, the Anti-Phishing Landing Page proposed by CMU researchers seems promising as it appears in the most teachable moment -namely once someone clicked on a link and was very likely to fall for phishing. While this page is already in use and exists in many languages we show that it is not effective in Germany as most users leave the page immediately without having read any advice. We therefore explore options to adopt their ideas for Germany. We focus on which are the trustworthy institutes that could provide such a landing page on their web pages and what is an appropriate headline and design.

NoPhish: An Anti-Phishing Education App

“…We followed a user-centered design, including an initial user survey to get an idea of the users' preferences with regard to an educational app. The results of our survey confirmed previous findings by Volkamer et al [8] that for a German audience (adults at least) a rather neutral game based approach would be best accepted. Furthermore, we involved potential users in early stages by asking them to evaluate app texts before integrating them into the final game.…”

Developing and Evaluating a Five Minute Phishing Awareness Video

“…A further study [22] built upon the evaluation in [23,24] and tested the participants' retention via multiple simulated phishing emails sent over the course of 28 days, with the results showing no significant loss of retention by the end of study. A similar approach but with spear phishing messages was studied in [9,38]. The study in [10] further evaluated the effectiveness of an anti-phishing training based on three simulated phishing trials over a two month period, showing significant improvements even after the end of the study.…”

Learn to Spot Phishing URLs with the Android NoPhish App

“…emails [25]. This is done by enabling them to send themselves with the NoPhish app an email from a sender address they provide in a corresponding form; and with a content they provide there as well.…”