Social engineering and organisational dependencies in phishing attacks

Research output: Chapter in Book/Report/Conference proceedingConference proceeding contributionResearchpeer-review

Abstract

Phishing emails are a widespread cybersecurity attack method. Their breadth and depth have been on the rise as they target individuals and organisations with increased sophistication. In particular, social engineering in phishing focuses on human vulnerabilities by exploiting established psychological and behavioural cues to increase the credibility of phishing emails. This work presents the results of a 56,000-participant phishing attack simulation carried out within a multi-national financial organisation. The overarching hypothesis was that strong cultural and contextual factors impact employee vulnerability. Thus, five phishing emails were crafted, based on three of Cialdini’s persuasion principles used in isolation and in combination. Our results showed that Social proof was the most effective attack vector, followed by Authority and Scarcity. Furthermore, we examined these results in the light of a set of demographic and organisational features. Finally, both click-through rates and reporting rates were examined, to provide rich insights to developers of cybersecurity educational solutions.
LanguageEnglish
Title of host publicationHuman-Computer Interaction – INTERACT 2019
Subtitle of host publication17th IFIP TC 13 International Conference, Proceedings, Part I
EditorsDavid Lamas, Fernando Loizides, Lennart Nacke, Helen Petrie, Marco Winckler, Panayiotis Zaphiris
Place of PublicationSwitzerland
PublisherSpringer, Springer Nature
Pages564-584
Number of pages20
ISBN (Electronic)9783030293819
ISBN (Print)9783030293802
DOIs
Publication statusPublished - 2019
Event17th IFIP TC.13 International Conference on Human-Computer Interaction – INTERACT 2019 - Paphos, Cyprus
Duration: 2 Sep 20196 Sep 2019
http://interact2019.org/

Publication series

NameLecture Notes in Computer Science
No.11746
ISSN (Print)0302-9743
ISSN (Electronic)1611-3349

Conference

Conference17th IFIP TC.13 International Conference on Human-Computer Interaction – INTERACT 2019
Abbreviated titleINTERACT 2019
CountryCyprus
CityPaphos
Period2/09/196/09/19
Internet address

Fingerprint

Electronic mail
Personnel

Cite this

Taib, R., Yu, K., Berkovsky, S., Bayl-Smith, P., & Wiggins, M. (2019). Social engineering and organisational dependencies in phishing attacks. In D. Lamas, F. Loizides, L. Nacke, H. Petrie, M. Winckler, & P. Zaphiris (Eds.), Human-Computer Interaction – INTERACT 2019: 17th IFIP TC 13 International Conference, Proceedings, Part I (pp. 564-584). (Lecture Notes in Computer Science; No. 11746). Switzerland: Springer, Springer Nature. https://doi.org/10.1007/978-3-030-29381-9_35
Taib, Ronnie ; Yu, Kun ; Berkovsky, Shlomo ; Bayl-Smith, Piers ; Wiggins, Mark. / Social engineering and organisational dependencies in phishing attacks. Human-Computer Interaction – INTERACT 2019: 17th IFIP TC 13 International Conference, Proceedings, Part I. editor / David Lamas ; Fernando Loizides ; Lennart Nacke ; Helen Petrie ; Marco Winckler ; Panayiotis Zaphiris. Switzerland : Springer, Springer Nature, 2019. pp. 564-584 (Lecture Notes in Computer Science; 11746).
@inproceedings{f07059a77ed54e9fab28f85a287018a4,
title = "Social engineering and organisational dependencies in phishing attacks",
abstract = "Phishing emails are a widespread cybersecurity attack method. Their breadth and depth have been on the rise as they target individuals and organisations with increased sophistication. In particular, social engineering in phishing focuses on human vulnerabilities by exploiting established psychological and behavioural cues to increase the credibility of phishing emails. This work presents the results of a 56,000-participant phishing attack simulation carried out within a multi-national financial organisation. The overarching hypothesis was that strong cultural and contextual factors impact employee vulnerability. Thus, five phishing emails were crafted, based on three of Cialdini’s persuasion principles used in isolation and in combination. Our results showed that Social proof was the most effective attack vector, followed by Authority and Scarcity. Furthermore, we examined these results in the light of a set of demographic and organisational features. Finally, both click-through rates and reporting rates were examined, to provide rich insights to developers of cybersecurity educational solutions.",
keywords = "cybersecurity, phishing, social engineering, simulation, behavioral study",
author = "Ronnie Taib and Kun Yu and Shlomo Berkovsky and Piers Bayl-Smith and Mark Wiggins",
year = "2019",
doi = "10.1007/978-3-030-29381-9_35",
language = "English",
isbn = "9783030293802",
series = "Lecture Notes in Computer Science",
publisher = "Springer, Springer Nature",
number = "11746",
pages = "564--584",
editor = "David Lamas and Fernando Loizides and Lennart Nacke and Helen Petrie and Marco Winckler and Panayiotis Zaphiris",
booktitle = "Human-Computer Interaction – INTERACT 2019",
address = "United States",

}

Taib, R, Yu, K, Berkovsky, S, Bayl-Smith, P & Wiggins, M 2019, Social engineering and organisational dependencies in phishing attacks. in D Lamas, F Loizides, L Nacke, H Petrie, M Winckler & P Zaphiris (eds), Human-Computer Interaction – INTERACT 2019: 17th IFIP TC 13 International Conference, Proceedings, Part I. Lecture Notes in Computer Science, no. 11746, Springer, Springer Nature, Switzerland, pp. 564-584, 17th IFIP TC.13 International Conference on Human-Computer Interaction – INTERACT 2019, Paphos, Cyprus, 2/09/19. https://doi.org/10.1007/978-3-030-29381-9_35

Social engineering and organisational dependencies in phishing attacks. / Taib, Ronnie; Yu, Kun; Berkovsky, Shlomo; Bayl-Smith, Piers; Wiggins, Mark.

Human-Computer Interaction – INTERACT 2019: 17th IFIP TC 13 International Conference, Proceedings, Part I. ed. / David Lamas; Fernando Loizides; Lennart Nacke; Helen Petrie; Marco Winckler; Panayiotis Zaphiris. Switzerland : Springer, Springer Nature, 2019. p. 564-584 (Lecture Notes in Computer Science; No. 11746).

Research output: Chapter in Book/Report/Conference proceedingConference proceeding contributionResearchpeer-review

TY - GEN

T1 - Social engineering and organisational dependencies in phishing attacks

AU - Taib,Ronnie

AU - Yu,Kun

AU - Berkovsky,Shlomo

AU - Bayl-Smith,Piers

AU - Wiggins,Mark

PY - 2019

Y1 - 2019

N2 - Phishing emails are a widespread cybersecurity attack method. Their breadth and depth have been on the rise as they target individuals and organisations with increased sophistication. In particular, social engineering in phishing focuses on human vulnerabilities by exploiting established psychological and behavioural cues to increase the credibility of phishing emails. This work presents the results of a 56,000-participant phishing attack simulation carried out within a multi-national financial organisation. The overarching hypothesis was that strong cultural and contextual factors impact employee vulnerability. Thus, five phishing emails were crafted, based on three of Cialdini’s persuasion principles used in isolation and in combination. Our results showed that Social proof was the most effective attack vector, followed by Authority and Scarcity. Furthermore, we examined these results in the light of a set of demographic and organisational features. Finally, both click-through rates and reporting rates were examined, to provide rich insights to developers of cybersecurity educational solutions.

AB - Phishing emails are a widespread cybersecurity attack method. Their breadth and depth have been on the rise as they target individuals and organisations with increased sophistication. In particular, social engineering in phishing focuses on human vulnerabilities by exploiting established psychological and behavioural cues to increase the credibility of phishing emails. This work presents the results of a 56,000-participant phishing attack simulation carried out within a multi-national financial organisation. The overarching hypothesis was that strong cultural and contextual factors impact employee vulnerability. Thus, five phishing emails were crafted, based on three of Cialdini’s persuasion principles used in isolation and in combination. Our results showed that Social proof was the most effective attack vector, followed by Authority and Scarcity. Furthermore, we examined these results in the light of a set of demographic and organisational features. Finally, both click-through rates and reporting rates were examined, to provide rich insights to developers of cybersecurity educational solutions.

KW - cybersecurity

KW - phishing

KW - social engineering

KW - simulation

KW - behavioral study

U2 - 10.1007/978-3-030-29381-9_35

DO - 10.1007/978-3-030-29381-9_35

M3 - Conference proceeding contribution

SN - 9783030293802

T3 - Lecture Notes in Computer Science

SP - 564

EP - 584

BT - Human-Computer Interaction – INTERACT 2019

PB - Springer, Springer Nature

CY - Switzerland

ER -

Taib R, Yu K, Berkovsky S, Bayl-Smith P, Wiggins M. Social engineering and organisational dependencies in phishing attacks. In Lamas D, Loizides F, Nacke L, Petrie H, Winckler M, Zaphiris P, editors, Human-Computer Interaction – INTERACT 2019: 17th IFIP TC 13 International Conference, Proceedings, Part I. Switzerland: Springer, Springer Nature. 2019. p. 564-584. (Lecture Notes in Computer Science; 11746). https://doi.org/10.1007/978-3-030-29381-9_35