3 research outputs found
Protecting People from Phishing: The Design and Evaluation of an Embedded Training Email System
Phishing attacks, in which criminals lure Internet users to
websites that impersonate legitimate sites, are occurring with
increasing frequency and are causing considerable harm to
victims. In this paper we describe the design and evaluation
of an embedded training email system that teaches people
about phishing during their normal use of email. We
conducted lab experiments contrasting the effectiveness of
standard security notices about phishing with two embedded
training designs we developed. We found that embedded
training works better than the current practice of sending
security notices. We also derived sound design principles for
embedded training systems
Protecting People from Phishing: The Design and Evaluation of an Embedded Training Email System
Phishing attacks, in which criminals lure Internet users to
websites that impersonate legitimate sites, are occurring
with increasing frequency and are causing considerable
harm to victims. In this paper we describe the design and
evaluation of an embedded training email system that
teaches people about phishing during their normal use of
email. We conducted lab experiments contrasting the
effectiveness of standard security notices about phishing
with two embedded training designs we developed. We
found that embedded training works better than the current
practice of sending security notices. We also derived sound
design principles for embedded training systems
Getting Users to Pay Attention to Anti-Phishing Education: Evaluation of Retention and Transfer
Educational materials designed to teach users not to fall for
phishing attacks are widely available but are often ignored by
users. In this paper, we extend an embedded training methodology
using learning science principles in which phishing education is
made part of a primary task for users. The goal is to motivate
users to pay attention to the training materials. In embedded
training, users are sent simulated phishing attacks and trained after
they fall for the attacks. Prior studies tested users immediately
after training and demonstrated that embedded training improved
users’ ability to identify phishing emails and websites. In the
present study, we tested users to determine how well they retained
knowledge gained through embedded training and how well they
transferred this knowledge to identify other types of phishing
emails. We also compared the effectiveness of the same training
materials delivered via embedded training and delivered as regular
email messages. In our experiments, we found that: (a) users learn
more effectively when the training materials are presented after
users fall for the attack (embedded) than when the same training
materials are sent by email (non-embedded); (b) users retain and
transfer more knowledge after embedded training than after nonembedded
training; and (c) users with higher Cognitive Reflection
Test (CRT) scores are more likely than users with lower CRT
scores to click on the links in the phishing emails from companies
with which they have no account