Research on the Credulity of Spear-Phishing Attacks for Lithuanian Education Institutions’ Employees
Source abstract
Abstract
Organizational security assurance is a complex and multi-dimensional task. One of the biggest threats to an organization is the credulity of phishing attacks for its employees. To prevent attacks, employees must maintain cyber security hygiene and increase their awareness of the cyberattack landscape. In this paper, we investigate how selected Lithuanian education system employees are vulnerable to spear-phishing attacks. In various education organizations, spear-phishing attacks were imitated, and user responses to received emails were monitored and analyzed. Each organization needs a different attention because employee behavior varies. Employees’ reaction time dimension is explored in the research. Based on these results, it appears that the organization has no time for delayed responses. Employees in the education system are highly affected by spear-phishing attacks and need less than one minute to provide attacker-requested data. This illustrates that automated e-mail filtering systems are a key element in the fight against these kinds of attacks.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Spam and Phishing Detection · Internet Traffic Analysis and Secure E-voting · Advanced Malware Detection Techniques
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Department of Information Systems, Vilnius Gediminas Technical University, 10223 Vilnius, Lithuania
Department of Information Technologies, Vilnius Gediminas Technical University, 10223 Vilnius, Lithuania
Department of Management, Vilnius Gediminas Technical University, 10223 Vilnius, Lithuania
References (45)
Show source-provided references
1. Defining social engineering in cybersecurity10.1109/ACCESS.2020.2992807 ↗
2. (2023, May 29). APWG: Phishing Activity Trends Reports. Available online: https://apwg.org/trendsreports/.
3. Salahdine, F., and Kaabouch, N. (2019). Social engineering attacks: A survey. Future Internet, 11.10.3390/fi11040089 ↗
4. Roy, S.S., Naragam, K.V., and Nilizadeh, S. (2023, May 29). Generating Phishing Attacks Using ChatGPT. Available online: https://arxiv.org/abs/2305.05133.
5. Alghenaim, M.F., Bakar, N.A.A., Abdul Rahim, F., Vanduhe, V.Z., and Alkawsi, G. (2022, January 20–21). Phishing Attack Types and Mitigation: A Survey. Proceedings of the International Conference on Data Science and Emerging Technologies, Khulna, Bangladesh.10.1007/978-981-99-0741-0_10 ↗
6. Wosah, N.P., and Win, T. (2021). Phishing mitigation techniques: A literature survey. arXiv.
7. Social engineering in cybersecurity: Effect mechanisms, human vulnerabilities and attack methods10.1109/ACCESS.2021.3051633 ↗
8. Rastenis, J., Ramanauskaitė, S., Janulevičius, J., and Čenys, A. (2020, January 16–19). Impact of Information Security Training on Recognition of Phishing Attacks: A Case Study of Vilnius Gediminas Technical University. Proceedings of the Databases and Information Systems: 14th International Baltic Conference, DB&IS 2020, Tallinn, Estonia. Proceedings 14.10.1007/978-3-030-57672-1_23 ↗
9. A review on phishing attacks
10. Smart phishing detection in web pages using supervised deep learning classification and optimization technique adam10.1007/s11277-021-08196-7 ↗
11. Web phishing detection techniques: A survey on the state-of-the-art, taxonomy and future directions10.1049/iet-net.2020.0078 ↗
12. Deep learning for phishing detection: Taxonomy, current challenges and future directions10.1109/ACCESS.2022.3151903 ↗
13. Rashid, J., Mahmood, T., Nisar, M.W., and Nazir, T. (2020, January 3–5). Phishing detection using machine learning technique. Proceedings of the 2020 First International Conference of Smart Systems and Emerging Technologies (SMARTTECH), Riyadh, Saudi Arabia.10.1109/SMART-TECH49988.2020.00026 ↗
14. Phishing email detection using natural language processing techniques: A literature survey10.1016/j.procs.2021.05.077 ↗
15. Hybrid phishing detection using joint visual and textual identity10.1016/j.eswa.2023.119723 ↗
16. The need for new antiphishing measures against spear-phishing attacks10.1109/MSEC.2019.2940952 ↗
17. Don’t click: Towards an effective anti-phishing training. A comparative literature review10.1186/s13673-020-00237-7 ↗
18. Mitchell, A. (2020, January 12). Improving Cybersecurity Behaviors: A Proposal for Analyzing Four Types of Phishing Training. Proceedings of the WISP 2020, Virtual.
19. Evaluating Organizational Phishing Awareness Training on an Enterprise Scale10.1016/j.cose.2023.103364 ↗
20. Indicators of employee phishing email behaviours: Intuition, elaboration, attention, and email typology10.1016/j.ijhcs.2023.102996 ↗
21. Shakela, V., and Jazri, H. (2019, January 5–6). Assessment of spear phishing user experience and awareness: An evaluation framework model of spear phishing exposure level (spel) in the namibian financial industry. Proceedings of the 2019 International Conference on Advances in Big Data, Computing and Data Communication Systems (icABCD), Winterton, South Africa.10.1109/ICABCD.2019.8851058 ↗
22. Abroshan, H., Devos, J., Poels, G., and Laermans, E. (2021, January 21–25). A phishing mitigation solution using human behaviour and emotions that influence the success of phishing attacks. Proceedings of the 29th ACM Conference on User Modeling, Adaptation and Personalization, Utrecht, The Netherlands.10.1145/3450614.3464472 ↗
23. SoK: Human-centered phishing susceptibility10.1145/3575797 ↗
24. Personalized persuasion: Quantifying susceptibility to information exploitation in spear-phishing attacks10.1016/j.apergo.2022.103908 ↗
25. Contextual drivers of employees’ phishing susceptibility: Insights from a field study10.1016/j.dss.2022.113818 ↗
26. Cybersecurity awareness enhancement: A study of the effects of age and gender of Thai employees associated with phishing attacks10.1007/s10639-021-10806-7 ↗
27. An examination of susceptibility to spear phishing cyber attacks in non-English speaking communities
28. Reinheimer, B., Aldag, L., Mayer, P., Mossano, M., Duezguen, R., Lofthouse, B., Von Landesberger, T., and Volkamer, M. (2020, January 10–11). An investigation of phishing awareness and education over time: When and how to best remind users. Proceedings of the Sixteenth Symposium on Usable Privacy and Security (SOUPS 2020), Online.
29. Alghenaim, M.F., Bakar, N.A.A., and Rahim, F.A. Awareness of Phishing Attacks in the Public Sector: Review Types and Technical Approaches. Proceedings of the International Conference on Emerging Technologies and Intelligent Systems.
30. Sixteen Years of Phishing User Studies: What Have We Learned?10.1109/TDSC.2022.3151103 ↗
31. Which phish is captured in the net? Understanding phishing susceptibility and individual differences10.1002/acp.4075 ↗
32. Uncovering the role of optimism bias in social media phishing: An empirical study on TikTok10.1080/0144929X.2023.2230305 ↗
33. Who Responds to Phishing Emails? An International Investigation of 15-Year-Olds Using Pisa Data10.1080/00071005.2023.2234456 ↗
34. Predicting Phishing Victimization: Comparing Prior Victimization, Cognitive, and Emotional Styles, and Vulnerable or Protective E-mail Strategies10.1080/15564886.2023.2218369 ↗
35. The role of conscientiousness and cue utilisation in the detection of phishing emails in controlled and naturalistic settings10.1080/0144929X.2023.2230307 ↗
36. Unraveling the behavioral influence of social media on phishing susceptibility: A Personality-Habit-Information Processing model10.1016/j.im.2023.103858 ↗
37. Spear phishing in a barrel: Insights from a targeted phishing campaign10.1080/10919392.2019.1552745 ↗
38. Phishing susceptibility across industries: The differential impact of influence techniques10.1016/j.cose.2023.103487 ↗
39. Rastenis, J., Ramanauskaitė, S., Janulevičius, J., Čenys, A., Slotkienė, A., and Pakrijauskas, K. (2020). E-mail-based phishing attack taxonomy. Appl. Sci., 10.10.3390/app10072363 ↗
40. Rastenis, J., Ramanauskaitė, S., Janulevičius, J., and Čenys, A. (2019, January 25). Credulity to phishing attacks: A real-world study of personnel with higher education. Proceedings of the 2019 Open Conference of Electrical, Electronic and Information Sciences (eStream), Vilnius, Lithuania.10.1109/eStream.2019.8732169 ↗
41. Study of Student Personality Trait on Spear-Phishing Susceptibility Behavior
42. Determining psycholinguistic features of deception in phishing messages10.1108/ICS-11-2021-0185 ↗
43. How to safely reassess variability and adapt sample size? A primer for the independent samples t test10.1177/25152459231212128 ↗
44. PhishingRTDS: A real-time detection system for phishing attacks using a Deep Learning model10.1016/j.cose.2024.103843 ↗
45. Novel interpretable and robust web-based AI platform for phishing email detection10.1016/j.compeleceng.2024.109625 ↗