Teaching Phishing-Security: Which Way is Best?

Abstract

Abstract. Ever more processes of our daily lives are shifting into the digital realm. Consequently, users face a variety of IT-security threats with possibly severe ramifications. It has been shown that technical measures alone are insufficient to counter all threats. For instance, it takes technical measures on average 32 hours before identifying and blocking phishing websites. Therefore, teaching users how to identify malicious websites is of utmost importance, if they are to be protected at all times. A number of ways to deliver the necessary knowledge to users exist. Among the most broadly used are instructor-based, computer-based and text-based training. We compare all three formats in the security context, or to be more precise in the context of anti-phishing training.

Effectiveness of and user preferences for security awareness training methodologies

“…The first provides a general introduction to phishing, a brief overview of the techniques used by cybercriminals, their potential consequences, and the indicators to help detect illegitimate emails and URLs. The second provides additional instruction on how to avoid being deceived by phishing emails or URLs. Game-based training (self-paced, both groups): Many studies [10, 11, 13, 15, 16, 20, 21, 22] leverage game-play to interactively educate users. Training games allow users to play interactively with challenges to decide if emails are trustworthy.…”

“…This study uses the web browser-based game Anti-Phishing Phil [13] (freely accessible at http://www.ucl.ac.uk/cert/antiphishing/) and Anti-Phishing Phyllis ( free demo version at https://beta.wombatsecurity.com/webdemo/4.7/?module=phyllis). Both games played completely take between five and 10 min. Text-based training (self-paced, both groups): An educational text was created based on freely available material [13, 15, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31] including examples and describing the best practices to detect phishing emails. The content is identical to the instructor-led training presentation with a brief introduction to phishing, an example with its possible consequences, indicators of illegitimate emails and URL addresses, and additional examples of phishing emails and websites.…”

“…Furthermore, Stockhardt et al. [15] and Abawajy and Kim [16] showed that distinct types of training have different impacts on the ability to identify phishing emails. Additional experts [17] agree that a mix of training approaches is most promising.…”

Productivity vs security: mitigating conflicting goals in organizations

“…Our proposed concept requires the goals to be derived from behavioral recommendations of information security awareness materials. We chose an extended version of the NoPhish anti-phishing awareness and education materials (Stockhardt et al, 2016) as basis for our goal derivation. They were a perfect fit, since they include clear behavioral recommendations and their effectiveness was proven in many settings (Canova et al, 2014;Kunz et al, 2016;Stockhardt et al, 2016).…”

Developing and Evaluating a Five Minute Phishing Awareness Video

“…Our research group has a long history of developing phishing awareness programmes (including apps, flyers, reading material, presentations for seminars) and have carried out several user studies verifying their effectiveness [5][6][7]26,28,33,[39][40][41]. Our initial programmes required learners to spend between 20 to 45 minutes completing the awareness programmes.…”