ABSTRACT

Approximately 65% of the organizations in the United States have fallen victim to a successful phishing attack. Many organizations offer anti-phishing training to their employees to defend against phishing attacks. The purpose of this study is to examine factors impacting the effectiveness of anti-phishing training and study the relationship between personality traits and phishing susceptibility. Participants filled out pre- and post-training surveys that included questions on identifying phishing and legitimate URLs and questions to determine DISC (Dominant, Influence, Steadiness, and Conscientiousness) personality traits. An analysis of the survey data shows that the participants’ average accuracy in detecting phishing URLs increased 8% (t = 2.144, p-value = 0.0374) and their confidence in their answer choices increased 6% (t = 2.032, p-value = 0.0464) from pre-training to post-training surveys. Before and after training, participants with the Influence personality trait had the lowest susceptibility while both Dominant and Steadiness personalities had the highest susceptibility before and after training respectively.

摘要

美国大约 65% 的组织已成为成功的网络钓鱼攻击的受害者。许多组织为其员工提供反网络钓鱼培训，以防御网络钓鱼攻击。本研究的目的是检查影响反网络钓鱼培训有效性的因素，并研究人格特征与网络钓鱼易感性之间的关系。参与者填写了培训前和培训后的调查，其中包括有关识别网络钓鱼和合法 URL 的问题以及确定 DISC（支配性、影响力、稳定性和责任心）人格特征的问题。对调查数据的分析表明，参与者检测钓鱼 URL 的平均准确率提高了 8%（t = 2.144，p-value = 0.0374) 并且他们对答案选择的信心从训练前到训练后调查增加了 6% (t = 2.032, p -value = 0.0464)。在训练之前和之后，具有影响型人格特质的参与者的易感性最低，而支配型和稳定型人格特质的参与者分别在训练前后的易感性最高。