Name It, Frame It, Check It: A 3-Step Fix for Phishing
Why do employees still fall for phishing after security training? A cognitive security experiment explores how objective thinking may reduce risk.
A cognitive security researcher conducted an experiment to discover if focusing on neutral facts rather than emotions could help reduce phishing attempts. The researcher surveyed corporate workers and found that most executives considered superficial compliance as the most challenging problem. However, employees who are most familiar with security rules are sometimes still duped.
The researcher then trained 24 participants from Reddit, half on common social engineering tactics and half on those tactics plus a method for analyzing emails objectively. The objective method involved finding the command, summarizing the email in third-person language, and checking with IT/Security if uncertain. After 14 days, the researcher sent all participants a surprise phishing test email.
Six people from the control group fell for the test, while only one person from the experimental group responded. The researcher concluded that by focusing on looking for the command, summarizing the email message in third-person language, and checking with IT/Security if unsure, employees were more likely to make the right decision and avoid phishing attempts.
Written by urgent.news from HackerNoon's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
