Phishing in a university community: Two large scale phishing experiments

Document Type

Conference Proceeding

Source of Publication

2012 International Conference on Innovations in Information Technology, IIT 2012

Publication Date

7-13-2012

Abstract

Phishing is a type of social engineering where a potential victim is sent a message that impersonates a legitimate source or organization. Phishing attacks typically lure the targets into revealing confidential information such as password, credit card details, bank account numbers, or any other sensitive information. Human behavior and technology are two equally important aspects of phishing attacks, while current anti-phishing research have focused on the technology front, very few real life studies have been performed with a focus on the human aspects of phishing attacks. In this paper, we present the results of two large scale real life phishing attacks conducted on more than 10,000 community members of a university that includes students, alumni, faculty and staff. Our study is the first large scale phishing experiment on human subjects. Previous work suggests that users' demographics are useful indicators in identifying the most vulnerable users to phishing attacks. Our results illustrate that user demographics alone cannot predict user's susceptibility to phishing attacks. We also found that warning users about phishing risks alone is not sufficient to prevent more users from responding to the phishing attack. Even though subjects were warned not to respond to phishing emails, many disregarded the warning. We explain our findings through analysis of the empirical results of the two real life phishing attacks conducted. © 2012 IEEE.

ISBN

9781467311014

Publisher

IEEE

First Page

249

Last Page

254

Disciplines

Computer Sciences | Social and Behavioral Sciences

Keywords

cyber security, personality trait, phishing, social engineering, user vulnerability

Scopus ID

84863618391

Indexed in Scopus

yes

Open Access

no

Link to Full Text

Share

COinS