Protecting people from phishing: the design and evaluation of an embedded training email system

By Ponnurangam Kumaraguru, Yong Woo Rhee, Alessandro Acquisti, Lorrie Faith Cranor, Jason I. Hong, Elizabeth Ferrall-Nunge. International Conference on Human Factors in Computing Systems, 2007

369 citations recorded by the source corpus.

Subfields: Information Systems, Signal Processing

View Paper: https://www.semanticscholar.org/paper/9a111eb891e520a88d8b3ed704707faf1f848cd4

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Information Systems

In Signal Processing

Citations in the corpus

Anti-Phishing Phil: the design and evaluation of a game that teaches people not to fall for phish (2007, methodology): “These questions have served as good filters to recruit non-experts in other phishing-related studies [7], [22].”
PhishZoo: Detecting Phishing Websites by Looking at Them (2011, neutral): “ing attacks and human detection methods [9].”
Cyber Security Awareness, Knowledge and Behavior: A Comparative Study (2020, background): “Since the human factor has already been shown to main cause of cyber breaches, ever more cyber awareness training programs are offered by academic institutions and private companies, with the aim of increasing individual cyber-crime awareness (Dodge 30 ; Kumaraguru et al. 31 ; Shaw et al. 29 ).”
An Empirical Analysis of Phishing Blacklists (2009, background): “[20, 34]) and to design trusted user interfaces (eg.”
Security awareness of computer users: A phishing threat avoidance perspective (2014, background): “Previous research has revealed that well-designed user security education can be effective (Kumaraguru et al., 2007a,b; Sheng et al., 2007).”
Who falls for phish?: a demographic analysis of phishing susceptibility and effectiveness of interventions (2010, background): “In this study, similar to previous studies, we found that about 90% of participants who would click on a phishing link would go on to provide information to phishing websites [17, 18].”
Anti-Phishing Landing Page : Turning a 404 into a Teachable Moment for End Users (2009, neutral): “However, the current practice of employers and service providers sending out security notices did little to protect users from phishing attacks as most users do not read these messages carefully, if at all [11].”
School of phish: a real-world evaluation of anti-phishing training (2009, background): “Our previous work also suggests that PhishGuru can eﬀectively train employees in a real-world setting [12].”
Nudges for Privacy and Security (2017, methodology): “This approach has been used to nudge users to learn how to better protect themselves from phishing attacks [Kumaraguru et al. 2007].”
You've been warned: an empirical study of the effectiveness of web browser phishing warnings (2008, result): “We believe that the coincidental nature of this attack was the reason why many more participants fell for our attacks than what has been found in similar studies [8, 7, 19, 14, 20].”
Phishing Detection: A Literature Survey (2013, methodology): “The phishing emails are simulated and expected to be generated by the system administrators [11].”
Teaching Johnny not to fall for phish (2010, methodology): “In Section 5.3, we present a study measuring users knowledge retention and knowledge transfer after PhishGuru training [Kumaraguru et al. 2007b].”
User preference of cyber security awareness delivery methods (2014, background): “The eﬀectiveness of some of these online materials was examined and it was found that, while these materials could be improved, they are surprisingly eﬀective when users actually read them (Kumaraguru et al. 2007).”
Getting users to pay attention to anti-phishing education: evaluation of retention and transfer (2007, methodology): “For example, in one lab study 93% of the participants who clicked on links provided their personal information [15].”
Cantina: a content-based approach to detecting phishing web sites (2007, methodology): “In previous work, we dev eloped an email-based approach to train people how to identif y and avoid phishing attacks, demonstrating that the existing p ractice of sending security notices is ineffective, while a st ory-based approach using a comic strip format was surprisingl y effective in teaching ”