Protecting people from phishing: the design and evaluation of an embedded training email system

Phishing attacks, in which criminals lure Internet users to websites that impersonate legitimate sites, are occurring with increasing frequency and are causing considerable harm to victims. In this paper we describe the design and evaluation of an embedded training email system that teaches people about phishing during their normal use of email. We conducted lab experiments contrasting the effectiveness of standard security notices about phishing with two embedded training designs we developed. We found that embedded training works better than the current practice of sending security notices. We also derived sound design principles for embedded training systems. Author Keywords Embedded training, phishing, email, usable privacy and security, situated learning ACM Classification Keywords

• Type: Conference
• Year: 2007
• Where: CHI
• Authors: Ponnurangam Kumaraguru, Yong Rhee, Alessandro Acquisti, Lorrie Faith Cranor, Jason I. Hong, Elizabeth Nunge
• Keywords: CHI 2007, Embedded Training Designs, Embedded Training Email, Human Computer Interaction, Keywords Embedded Training