Experimental Investigation of Demographic Factors Related to Phishing Susceptibility

This paper reports on a simulated phishing experiment targeting 6,938 faculty and staff at George Mason University. The study examined various possible predictors of phishing susceptibility. The focus of the present paper is on demographic factors (including age, gender and position/employment). Since previous studies of age and gender have yielded discrepant results, one purpose of the study was to disambiguate these findings. A second purpose was to compare different types of email phishing exploits. A third objective was to compare the effect of different types of feedback given to those who clicked on one or more of three simulated phishing exploits that were deployed over a three-week period. Our analysis of demographic factors, effects of phishing email content, and effects of repeated exposure to phishing exploits revealed significant age effects, marginally significant gender differences, and significant differences in email type. A multi-level model estimated effects of multiple variables simultaneously

Modeling Expert Judgments of Insider Threat Using Ontology Structure: Effects of Individual Indicator Threat Value and Class Membership

We describe research on a comprehensive ontology of sociotechnical and organizational factors for insider threat (SOFIT) and results of an expert knowledge elicitation study. The study examined how alternative insider threat assessment models may reflect associations among constructs beyond the relationships defined in the hierarchical class structure. Results clearly indicate that individual indicators contribute differentially to expert judgments of insider threat risk. Further, models based on ontology class structure more accurately predict expert judgments. There is some (although weak) empirical evidence that other associations among constructs—such as the roles that indicators play in an insider threat exploit—may also contribute to expert judgments of insider threat risk. These findings contribute to ongoing research aimed at development of more effective insider threat decision support tools

Effects of non-axisymmetric tip clearance on axial compressor performance and stability

September 1997Statement of responsibility on title-page reads: M.B. Graf, T.S. Wong, E.M. Greitzer, F.E. Marble, C.S. Tan, H-W Shin, D.C. WislerIncludes bibliographical references (pages 34-35)The effects of circumferentially non-uniform tip clearance on axial compressor performance and stability have been investigated experimentally and analytically. A theoretical model for compressor behavior with non-axisymmetric tip clearance has been developed and used to design a series of first-of-a-kind experiments on a four-stage, low speed compressor. The experiments and computational results together show clearly the central physical features and controlling parameters of compressor response to non-axisymmetric tip clearance. It was found that the loss in stall margin was more severe than that estimated based on average clearance. The stall point was, in fact, closer to that obtained with uniform clearance at the maximum clearance level. The circumferential length scale of the tip clearance (and accompanying flow asymmetry) was an important factor in determining the stall margin reduction.For the same average clearance, the loss in peak pressure rise was 50% higher for an asymmetry with fundamental wavelength equal to the compressor circumference than with wavelength equal to one-half the circumference. The clearance asymmetry had much less of an effect on peak efficiency; the measured maximum efficiency decrease obtained was less than 0.4 percent compared to the 8% decrease in peak pressure rise due to the asymmetric clearance. The efficiency penalty due to non-axisymmetric tip clearance was thus close to that obtained with a uniform clearance at the circumferentially-averaged level. The theoretical model accurately captured the decreases in both steady-state pressure rise and stable operating range which are associated with clearance asymmetry.It also gave a good description of the observed trends of (i) increasing velocity asymmetry with decreasing compressor flow, and (ii) decreasing effect of clearance asymmetry with decreasing dominant wavelength of the clearance distribution. The time resolved data showed that the spatial structure of the pre-stall propagating disturbances in the compressor annulus was well represented and that the stability limiting process could be linked to the unsteady structure of these disturbance modes. The model was also utilized for parametric studies to define how compressor performance and stability is affected by the circumferential distribution of clearance, steady-state compressor pressure-rise characteristic, and system dynamic parameters. Sensitivity to clearance asymmetry was found to fall off strongly with the (asymmetry-related) reduced frequency and to increase with peak pressure rise and increasing curvature of the characteristic near the peak.Sponsored by the Air Force Office of Scientific Research, and the Air Force Aero Propulsion Technology (AFRAPT) Progra

Situated Usability Testing for Security Systems

While usability testing is well established, assessing the usability of security software, tools, or methods deserves more careful consideration. It has been argued that dealing with security has become too difficult for individuals or organizations to manage effectively or to use conveniently. As difficult as it is for system administrators and developers to deal with, security is even more challenging for casual users. Indeed, it is much too easy for casual/home users to configure the security of their systems in non-optimal ways that leave their systems inadvertently insecure. This is exacerbated by the fact that casual users are focused on matters other than security, and likely would prefer not even to think about security. This brief report argues that when security and/or privacy are part of the equation, traditional methods for usability testing should be re-considered. The purpose of this brief report is to argue for and outline a method associated with a new approach to usability testing for examining usable security issues

Toward the development of cognitive task difficulty metrics to support intelligence analysis research

Intelligence analysis is a cognitively complex task that is the subject of considerable research aimed at developing methods and tools to aid the analysis process. To support such research, it is necessary to characterize the difficulty or complexity of intelligence analysis tasks in order to facilitate assessments of the impact or effectiveness of tools that are being considered for deployment. A number of informal accounts of "What makes intelligence analysis hard" are available, but there has been no attempt to establish a more rigorous characterization with well-defined difficulty factors or dimensions. This paper takes an initial step in this direction by describing a set of proposed difficulty metrics based on cognitive principles

Modeling Human Behavior to Anticipate Insider Attacks

The insider threat ranks among the most pressing cyber-security challengesthat threaten government and industry information infrastructures.To date, no systematic methods have been developed that provide acomplete and effective approach to prevent data leakage, espionage, andsabotage. Current practice is forensic in nature, relegating to the analystthe bulk of the responsibility to monitor, analyze, and correlate an overwhelmingamount of data. We describe a predictive modeling frameworkthat integrates a diverse set of data sources from the cyber domain, as wellas inferred psychological/motivational factors that may underlie maliciousinsider exploits. This comprehensive threat assessment approachprovides automated support for the detection of high-risk behavioral triggers to help focus the analyst\u27s attention and inform the analysis.Designed to be domain-independent, the system may be applied to manydifferent threat and warning analysis/sense-making problems