Comparing Phishing Training and Campaign Methods for Mitigating Malicious Emails in Organizations

Jackie Scott, Yair Levy, Wei Li, Ajoy Kumar

2024

Abstract

Although there have been numerous significant technological advancements in the last several decades, there continues to be a real threat as it pertains to social engineering, especially phishing, spear-phishing, and Business Email Compromise (BEC). While the technologies to protect end-users have gotten better, the ‘human factor’ in cybersecurity is the main penetration surface. These three phishing methods are used by attackers to infiltrate corporate networks and manipulate end-users, especially through business email. Our research study was aimed at assessing several phishing mitigation methods, including phishing training and campaign methods, as well as any human characteristics that enable a successful cyberattack through business email. Following expert panel validation for the experimental procedure, a pilot study with 172 users and then a full study with 552 users were conducted to collect six actual end-users’ negative response actions to phishing campaigns conducted with traditional Commercial-Off-The-Shelf (COTS) product (KnowBe4) and a red team. Users were randomly assigned to three groups: no training; traditional training; and longitudinal customized training with 1,104 data points collected. While the phishing method was significant, our results indicate that current training methods appear to provide little to no added value vs. no training at all.

Paper Citation

in Harvard Style

Scott J., Levy Y., Li W. and Kumar A. (2024). Comparing Phishing Training and Campaign Methods for Mitigating Malicious Emails in Organizations. In Proceedings of the 10th International Conference on Information Systems Security and Privacy - Volume 1: ICISSP; ISBN 978-989-758-683-5, SciTePress, pages 643-651. DOI: 10.5220/0012281600003648

in Bibtex Style

@conference{icissp24,
author={Jackie Scott and Yair Levy and Wei Li and Ajoy Kumar},
title={Comparing Phishing Training and Campaign Methods for Mitigating Malicious Emails in Organizations},
booktitle={Proceedings of the 10th International Conference on Information Systems Security and Privacy - Volume 1: ICISSP},
year={2024},
pages={643-651},
publisher={SciTePress},
organization={INSTICC},
doi={10.5220/0012281600003648},
isbn={978-989-758-683-5},
}

in EndNote Style

TY - CONF

JO - Proceedings of the 10th International Conference on Information Systems Security and Privacy - Volume 1: ICISSP
TI - Comparing Phishing Training and Campaign Methods for Mitigating Malicious Emails in Organizations
SN - 978-989-758-683-5
AU - Scott J.
AU - Levy Y.
AU - Li W.
AU - Kumar A.
PY - 2024
SP - 643
EP - 651
DO - 10.5220/0012281600003648
PB - SciTePress