Exploring susceptibility to phishing in the workplace. Issue 120 (December 2018)

• Record Type: Journal Article
• Authors: Williams, Emma J.; Hinds, Joanne; Joinson, Adam N.
• Is Part Of: International journal of human-computer studies. Issue 120(2018)
• Page Start: 1
• Page End: 13
• Publication Date: 2018-12
• Subjects: Phishing -- Organisational behavior -- Human factors -- Cyber security -- Employee susceptibility -- Social engineering; Human-machine systems -- Periodicals; Systems engineering -- Periodicals; Human engineering -- Periodicals; Human engineering; Human-machine systems; Systems engineering; Periodicals; Electronic journals; 004.019
• DOI: 10.1016/j.ijhcs.2018.06.004
• Languages: English
• ISSNs: 1071-5819

Abstract

Highlights: Susceptibility to phishing emails is explored in an ecologically valid setting. Authority and urgency techniques are found to impact employee susceptibility. Context-specific factors are also likely to impact employee susceptibility. A range of targeted initiatives are required to address susceptibility factors. Abstract: Phishing emails provide a means to infiltrate the technical systems of organisations by encouraging employees to click on malicious links or attachments. Despite the use of awareness campaigns and phishing simulations, employees remain vulnerable to phishing emails. The present research uses a mixed methods approach to explore employee susceptibility to targeted phishing emails, known as spear phishing. In study one, nine spear phishing simulation emails sent to 62, 000 employees over a six-week period were rated according to the presence of authority and urgency influence techniques. Results demonstrated that the presence of authority cues increased the likelihood that a user would click a suspicious link contained in an email. In study two, six focus groups were conducted in a second organisation to explore whether additional factors within the work environment impact employee susceptibility to spear phishing. We discuss these factors in relation to current theoretical approaches and provide implications for user communities.