An empirical investigation of the effect of target-related information in phishing attacks
2014 (English)In: 2014 IEEE 18th International Enterprise Distributed Object Computing Conference Workshops and Demonstrations (EDOCW), IEEE , 2014, 357-363 p.Conference paper (Refereed)
Analyzing the role of target-related information in a security attack is an understudied topic in the behavioral information security research field. This paper presents an empirical investigation of the effect of adding information about the target in phishing attacks. Data was collected by conducting two phishing experiments using a sample of 158 employees at five Swedish organizations. The first experiment included a traditional mass-email attack with no target-related information, and the second experiment was a targeted phishing attack in which we included specific information related to the targeted employees' organization. The results showed that the number of organizational employees falling victim to phishing significantly increased when target-related information was added in the attack. During the first experiment 5.1 % clicked on the malicious link compared to 27.2 % of the second phishing attack, and 8.9 % of those executed the binary compared to 3.2 % of the traditional phishing attack. Adding target-related information is an effective way for attackers to significantly increase the effectiveness of their phishing attacks. This is the first study that has showed this significant effect using organizational employees as a sample. The implications of the results are further discussed.
Place, publisher, year, edition, pages
IEEE , 2014. 357-363 p.
, International Enterprise Distributed Object Computing Conference. Proceedings, ISSN 1541-7719
direct observations, experiments, phishing, security behavior, Social engineering
Electrical Engineering, Electronic Engineering, Information Engineering
IdentifiersURN: urn:nbn:se:kth:diva-147691DOI: 10.1109/EDOCW.2014.59ScopusID: 2-s2.0-84919772804ISBN: 978-147995470-4OAI: oai:DiVA.org:kth-147691DiVA: diva2:731783
18th IEEE International Enterprise Distributed Object Computing Conference Workshops and Demonstrations, EDOCW 2014, Ulm, Germany, 1 September 2014 through 2 September 2014
QC 201502092014-07-022014-07-022016-05-03Bibliographically approved