Spear phishing in organisations explained

Abstract

Purpose The purpose of this study is to explore how the opening phrase of a phishing email influences the action taken by the recipient. Design/methodology/approach Two types of phishing emails were sent to 593 employees, who were asked to provide personally identifiable information (PII). A personalised spear phishing email opening was randomly used in half of the emails. Findings Nineteen per cent of the employees provided their PII in a general phishing email, compared to 29 per cent in the spear phishing condition. Employees having a high power distance cultural background were more likely to provide their PII, compared to those with a low one. There was no effect of age on providing the PII requested when the recipient’s years of service within the organisation is taken into account. Practical implications This research shows that success is higher when the opening sentence of a phishing email is personalised. The resulting model explains victimisation by phishing emails well, and it would allow practitioners to focus awareness campaigns to maximise their effect. Originality/value The innovative aspect relates to explaining spear phishing using four socio-demographic variables.

Human Cognition Through the Lens of Social Engineering Cyberattacks

“…A phishing email, for example, is unlikely to be effective if the message violates norms of the target's culture. We also consider the more specific case of organizational culture in the workplace because it is highly relevant to employee behavior as it applies to cyber security (Bullee et al, 2017 ). As with all of the other short-and long-term variables that we consider, culture is assumed to interact with the other variables, with particularly large interactions with age, gender, and perhaps personality.…”

“…Rocha Flores et al ( 2014 ) finds that there is no significant correlation between phishing resiliency and gender. Bullee et al ( 2017 ) finds that gender does not contribute to phishing message responses. Abbasi et al ( 2016 ) finds (i) women with a high self-efficacy have a low susceptibility to social engineering cyberattacks, and that women without awareness of the social engineering cyberattack threat have a high susceptibility to these attacks; and (ii) men with previous costly experiences with phishing attacks have a low susceptibility to these attacks, while overconfidence increases the susceptibility to these attacks.…”

“…Purkait et al ( 2014 ) find that the detection of phishing messages decreases with the age and frequency of online transactions. Bullee et al ( 2017 ) find that age has no effect on spear-phishing responses and that Years of Service (YoS) is a better indicator of victimization (i.e., a greater YoS means less likely susceptible to social engineering cyberattacks). Gavett et al ( 2017 ) examine the effect of age on phishing susceptibility and showed that processing speed and planning executive functions affect phishing suspicion, hinting a relationship between phishing susceptibility and cognitive degradation from aging.…”

A Semi-automated Security Advisory System to Resist Cyber-Attack in Social Networks

“…The taxonomy comprised three main entities that have been argued to form every social engineering attack, the operator of the attack, the type of the attack, and the attack channel. The attack can be originated by either a person which reflected a limited number of victims such as spear phishing [6] or by a malicious software which usually targeted a considerable huge number of users such as the cross-site scripting attack in SN [7].…”

A Demographic Perspective of Smartphone Security and Its Redesigned Notifications

“…Previous studies have only focused on users of similar or certain demographics: permanently residing in developed countries, certain age, certain socio-economic status etc., Refs. [11], [18], [19], [20]. Joinson et al posit that, in order to properly protect cybersecurity, it is important to integrate culture, behaviour and the design of security tools and policies [21].…”