I-Corps: A Platform to Automatically Measure Users Susceptibility to Social Engineering Attacks

Texas Tech University, Lubbock TX

Investigators

Abstract

The broader impact/commercial potential of this I-Corps project is the development of security awareness technology for corporate employees who are susceptible to social engineering attacks; i.e., phishing attacks. To identify those who are susceptible to phishing attacks, organizations typically self-phish, which is phishing one’s own employees and seeing who responds. Organizations concerned with cybersecurity may hire services or conduct phishing campaigns themselves. Self-phishing may only identify those who are extremely susceptible due to the relatively generic phishing emails that are typically used during such campaigns. Organizations that use self-phishing to identify susceptible workers may have a false sense of security. There is a continuing need for a ways to identify workers susceptible to more complex phishing campaigns. The proposed technology measures users’ susceptibility to phishing attacks from publicly available information about those users. This I-Corps project is based on the development of a technology platform to measure individuals in an organization that are susceptible to phishing attacks. The proposed technology uses publicly available information to quantify users’ personality traits, demographics, education, and experiences that are known to predict phishing susceptibility. That constellation of data is then used to compute an estimate how susceptible each user is to a phishing attack. The proposed platform may enhance an organization's efforts to identify individuals who would most benefit from security awareness training. In addition, the proposed technology may have a broad impact on enhancing penetration testing that targets people who are operating critical infrastructure, i.e., the weakest links in security systems. The project also may significantly impact the development of effective cybersecurity education. This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.