Cybersecurity Awareness Month 2023 Blog Series | Recognizing and Reporting Phishing – Source:www.nist.gov

During this week’s blog series, we sat down with two of our NIST experts from the Visualization and Usability Group at NIST — Shanée Dawkins and Jody Jacobs — who discussed the importance of recognizing and reporting phishing. This blog wraps up our Cybersecurity Awareness Month 2023 blog series…but we of course plan to continue to share, collaborate, learn, and spread the word all year long.

1. This week’s Cybersecurity Awareness Month theme is ‘recognize and report phishing.’ How does your work/specialty area at NIST tie into this behavior?

We work in the Information Technology Lab, but our research focuses on users of technology. Our group’s purpose is to champion the human in information technology, and we also apply that to our phishing efforts. While other research programs focus on the technology needed to filter out phishing emails, we focus on people as the last line of defense if a phishing email slips through the filters (and their ability or inability to recognize the phish). We research the circumstances that make people more or less susceptible to clicking on a phishing email – whether that be the characteristics of the email itself or the context of the user receiving the email.

Ultimately, our goal is to equip organizations with the metrics they need to effectively train their employees to recognize and report phishing emails. Many organizations use embedded phishing awareness training programs to assess their phishing-related security risks. In these programs, organizations send simulated phishing emails to their employees to gauge the rate at which employees click or report the phish. However, our findings show that click rates – whether people click or don’t click on links and attachments – do not provide a complete picture to understanding staff behaviors.  We created a metric, the NIST Phish Scale, to provide user context into clicking behaviors. The Phish Scale results in a human phishing detection difficulty metric that allows organizations to better tailor their phishing awareness training programs towards staff recognizing and reporting phishing more effectively.

2. How does recognizing and reporting phishing help people and/or businesses when it comes to cybersecurity? Why is it so important?

Phishing threats affect organizations of all sizes and sectors. Here are some stats – according to a recent survey by Proofpoint (source below), 34% of users did something in 2022 that put themselves or their organization at risk such as clicking on a malicious link. In the fourth quarter of 2022, Anti-Phishing Working Group (APWG) observed 1,350,037 total phishing attacks (source below). This was up slightly from the third quarter, when APWG recorded 1,270,883 total phishing attacks, which was a new record at the time and the worst quarter for phishing that APWG has ever observed. Business Email Compromise (BEC) still accounts for 75% of attacks and accounts for $2.7 Billion in losses, according to the FBI (source below).

Phishing emails are designed to deceive users and extract personal or work-related sensitive information from the email’s recipient (e.g., bank account information or usernames and passwords). Organizations use phishing training exercises to help employees defend against these types of phishing threats in a safe and controlled environment. The expectation is that employees will be better able to recognize and report phishing messages in the wild— reducing potential compromise of security and privacy for both the individual and their organization.

About the author

Comments