hello everyone
i'm really looking forward to presenting
you our work
on an investigation of fishing awareness
and education over time
when and how to best remind users to
start right off
we conducted a longitudinal study we
systematically measured a retention for
an on-site tutorial on phishing and
detection in an organization over 12
months
and we developed and tested reminder
measures to replenish awareness and
knowledge about fishing when both is
not sufficient anymore before going into
the detail about our study i want to say
a few words about
setting of the study and the four minor
measures we used
we cooperated with a state office for
geo information and state survey
the organization has about around 2.2
thousand employees
and all of these employees had to do a
mandatory
training in a tutorial so every employee
was trained in detecting fishing
um to stay as close to the actual
organization context the organization
used the train the trainer approach
within your fish course you know fish
cores what has already been studied in a
lot of different variants like android
app video or instructor-based training
and the no fish course was adapted
to the organization setting in a way
that used examples were actual examples
that the organization
received themselves for those 2.2
000 employees the participation in the
actual study about the awareness of
knowledge retention was optional
after cleaning data for reasons like
external help we ended up with 409
participants
starting with the reminder measures we
had some requirements they were supposed
to fulfill
the measure should remind them of every
aspect of the tutorial without having
additional information
content-wise we decided to put the
following information in the reminder
measures
first what actually can be dangerous in
the context of phishing
second how to check for plausibility and
third
how to examine urls links and
attachments
in the end we decided for four different
reminder measures the different kind of
representation of the same content
first of all we developed a text like a
leaflet
that has all the information in written
form with pictures but no interactivity
second we used a video that explains
everything with the story of a person
receiving phishing emails
with links and attachments third
we developed an interactive email
example that looks like an email
with different focus points that the
participant can hover over to get
information like how to find a domain
and an url finally we developed a short
text measure reducing the text to the
most essential parts
that can be used as rules to detect
phishing
now i want to present the results from
our study in more detail
all groups participated in the same
study with some only small variations in
the beginning of the study they received
the study details
for a role play that they were supposed
to follow afterwards
they had 20 screenshots in a random
order to judge whether they are
fraudulent or legitimate
the study concluded with a few control
questions like asking for external help
we found that the participants in the
group directly after the tutorial were
significantly better than before
and the same holds for the group after
four months
the group after six months was not
significantly better anymore
which does not mean that they were back
to the level as before
as we decided before that at such point
we will provide our reminder measures we
directly choose four groups with each
group receiving one reminder measure to
check whether this would improve their
awareness and knowledge back to a
significant level
we found that all of those groups except
for the short text achieved a
significantly better
result to before the tutorial
six months later so like 12 months after
the tutorial
we found that only two groups the video
and the interactive email example group
still achieved a significantly better
result
to sum up our results we systematically
measured the onsite tutorial and found
that it helped until
roughly four to six months afterwards
employees needed
a reminder measure like the interactive
email example a text or video
to help raise the awareness and
knowledge back to a significant level
looking at the results of the 12 months
one should probably only use the
interactive email example or the video
as a reminder measure thanks to
for listening and thanks for my
co-authors feel free to contact me via
my email
you