One Phish, Two Phish, How to Avoid the Internet Phish: Analysis of Training Strategies to Detect Phishing Emails. (September 2014)

• Record Type: Journal Article
• Authors: Zielinska, Olga A.; Tembe, Rucha; Hong, Kyung Wha; Ge, Xi; Murphy-Hill, Emerson; Mayhorn, Christopher B.
• Is Part Of: Proceedings of the Human Factors and Ergonomics Society ... Annual Meeting. Volume 58:Part 1(2014)
• Page Start: 1466
• Page End: 1470
• Publication Date: 2014-09
• Subjects: Human engineering -- Congresses; 620.8205
• DOI: 10.1177/1541931214581306
• Languages: English
• ISSNs: 1541-9312

Abstract

Phishing is a social engineering tactic that targets internet users in an attempt to trick them into divulging personal information. When opening an email, users are faced with the decision of determining if an email is legitimate or an attempt at phishing. Although software has been developed to assist the user, studies have shown they are not foolproof, leaving the user vulnerable. Multiple training programs have been developed to educate users in their efforts to make informed decisions; however, training that conveys the real world consequences of phishing or training that increases a user's fear level have not been developed. Conveying real world consequences of a situation and increasing a user's fear level have been proven to enhance the effects of training in other fields. Ninety-six participants were recruited and randomly assigned to training programs with phishing consequences, training programs designed to increase fear, or a control group. Preliminary results indicate that training helped users identify phishing emails; however, little difference was seen among the three groups. Future analysis will include a factor analysis of personality and individual differences that influence training efficacy.