hi everyone my name is Verena distler
and this is work I conducted at the
University of Luxembourg I'm now a
researcher at bundesburg University
Munich
today I'm presenting work titled the
influence of context on response to
spear phishing attacks and in C2
deception study
phishing attacks are very common and are
frequently the point of entry for
follow-up attacks that lead to many
types of harm
for instance some phishing attacks can
lead to follow-up ransomware attacks
which cause far-reaching organizational
Financial social and personal harm
fishing is inherently a socio-technical
problem and cannot be addressed by
technology alone
targeted phishing attacks are
particularly difficult to detect
so far few research has focused on how
context influences pre-experienced and
behavioral reactions to phishing and
reporting of phishing emails
this paper addresses three research
questions first I addressed a question
of what role contextual factors play in
successful phishing attacks
second I investigate how people
rationalize reporting or not reporting a
phishing attack
third I investigate the opportunities
people identify after being exposed to
an attack
this study took place in a European
University which regularly simulated
phishing attacks with their employees
for training purposes
I recruited 14 employees aiming to
include a diverse set of chop profiles
and work experience
the study participants included 10
research staff members with varying
experience levels three administrative
staff members and one it expert
apart from the I.T expert none of the
participants had a security HCI or
Computing background
in the study I used a novel methodology
that allowed me to observe what happened
when participants received a targeted
phishing email in their usual work
environment the method allowed me to
triangulate observed and interview data
to obtain rich and size into
participants emotions thoughts and
actions when receiving a targeted
phishing email
the study was approved by the
University's ethical review board and
going beyond the ethics approval I
ensured that participants would not
experience any harm as a result of their
study participation
to make an nc2 observation possible I
use the remote setup with a webcam to
start a video call to observe
participants participants were
instructed to work as per usual
including social interactions they may
usually have participants were free to
get up
the setup allowed me to observe for the
participants were doing on the computer
during the observation as well as their
reaction to the phishing email
this was a deception study while
participants knew that they were being
observed they were not aware that the
study was about phishing instead
participants were told that the study
was about technology use at work
the observation took approximately one
hour
during the observation participants
received a simulated spear phishing
email providing a unique opportunity to
observe a response to a phishing attack
in a realistic context
after the observation I interviewed the
participants and asked them to complete
a retrospective experience exercise
enabling them to reflect on their
experience
at this point participants were fully
debriefed about the deception
participants were encouraged to ask
questions and voice concerns I asked
participants if they were still willing
to participate in the study renewing
their consent
I try angularly the observed and
self-reported data with a summarizing
Content analysis
the entire study protocol is available
in the article
the simulated phishing email used
information that was easily available
online for a motivated attacker it aimed
to create a sense of urgency the
phishing email impersonated the direct
supervisor of the participant as an
authority queue
I will now summarize some key findings
to briefly describe the response to the
spearfishing attack we found that the
thought processes differed between
people who did not click on the phishing
link and those who did
participants who did not click on the
fishing link had a more complex thought
process which was triggered when they
noticed a suspicious element in the
spearfishing email for example the
language or writing style or the request
being sent in an unexpected
Communication channel
participants had some strategies in case
of Doubt which included asking a
colleague for help they would then
report the email to the IT department or
in most cases take an alternative action
participants who ended up clicking had a
more straightforward thought process in
comparison they saw the name of the
professor and immediately wanted to
fulfill the request the authority queue
created a sense of urgency
interestingly participants typically did
not read or interact with the training
website and instead close the window
quickly
the social environment of the office
played a relevant role social
interactions were used by some
participants to immediately inform
direct colleagues and their supervisor
of the phishing attack
for instance one of the participants
immediately called the professor who was
supposedly asking her to click on the
link informing them of the attack
of note none of the participants who
clicked on the fishing link talked about
it with anyone
participants felt a strong pressure to
respond to emails and other messages as
quickly as possible participants
reported feelings of stress and
overwhelm related to emails this could
have a negative influence on phishing
related Behavior
task context varied strongly along job
categories while research staff saw
emails as a distraction from other tasks
administrative staff saw emails as a
high priority task there was no pattern
of typical tasks participants who
clicked on the link were working on
compared to those who did not click
reasons to report a phishing email
included to improve the filters used by
the organization and participants also
mentioned that they liked receiving the
positive feedback after reporting a
suspected phishing email
reasons not to report included feeling
unsure of how and why to report and
participants also felt that it didn't
make sense to report a simulated
phishing email after they had already
clicked on the link
alternative behaviors included deleting
the email marking it as chunk or
forwarding it to the person being
impersonated
participants suggested the training
measures should avoid triggering
feelings of Shame by implying that the
employee had not paid attention to
previous training training should
instead acknowledge the context plays a
role in how somebody reacts to a
phishing email
participants suggested that there should
be specific training for advanced
phishing attacks such as targeted
attacks
they wanted to be informed about ongoing
attacks and suggested to clarify when
and why to report potential phishing
emails
the paper I discuss how changing
organizational Norms related to emails
might improve organizational resistance
to phishing attacks
it seems promising to leverage social
interactions further to counteract
phishing
it departments should clarify
expectations related to phishing
reporting
I also discuss how simulated
anti-efficient trainings might
inadvertently train people to interact
with phishing emails and not report
having clicked on a phishing email
future work should investigate the
effects of simulated anti-fishing
training including potential unwanted
effects
thank you I encourage you to read the
paper for more details I would like to
thank the research participants and the
HCI research group at the University of
Luxembourg