Investigation into Phishing Risk Behaviour among Healthcare Staff

Abstract

A phishing attack is one of the less complicated ways to circumvent sophisticated technical security measures. It is often used to exploit psychological (as as well as other) factors of human users to succeed in social engineering attacks including ransomware. Guided by the state-of-the-arts in a phishing simulation study in healthcare and after deeply assessing the ethical dilemmas, an SMSbased phishing simulation was conducted among healthcare workers in Ghana. The study adopted an in-the-wild study approach alongside quantitative and qualitative surveys. From the state-of-the art studies, the in-the-wild study approach was the most commonly used method as compared to laboratory-based experiments and statistical surveys because its findings are generally reliable and effective. The attack results also showed that 61% of the targeted healthcare staff were susceptible, and some of the healthcare staff were not victims of the attack because they prioritized patient care and were not susceptible to the simulated phishing attack. Through structural equation modelling, the workload was estimated to have a significant effect on self-efficacy risk (r = 0.5, p-value = 0.05) and work emergency predicted a perceived barrier in the reverse direction at a substantial level of r = −0.46, p-value = 0.00. Additionally, Pearson’s correlation showed that the perceived barrier was a predictor of self-reported security behaviour in phishing attacks among healthcare staff. As a result, various suggestions including an extra workload balancing layer of security controls in emergency departments and better security training were suggested to enhance staff’s conscious care behaviour.

How to safely communicate with a phishing attacker by email?

“…Another paper (Yeng, et al, 2022) conducts a quantitative and qualitative survey of doctors in the field on simulated phishing attacks using SMS. The results show that doctors who prioritized patient care were not as susceptible to those simulated phishing attacks because they did not pay attention to those messages.…”

An Effective Self-Configurable Ransomware Prevention Technique for IoMT

“…The process of transformation often makes use of several sorts of systems, such as software platforms, computer networks, and other types of network infrastructure. To identify phishing simulation research methods, technologies and research gaps in practically evaluated literature, a comprehensive review was carried out by Yeng et al [ 30 ]. Phishing serves as the most prevalent ransomware assault because it exploits the weakest link.…”