PhishGuru: A System for Educating Users about Semantic Attacks
•
2 j'aime•791 vues
Online security attacks are a growing concern among Internet users. Currently, the Internet community is facing three types of security attacks: physical, syntactic, and semantic. Semantic attacks take advantage of the way humans interact with computers or interpret messages. There are three major approaches to countering semantic attacks: silently eliminating the attacks, warning users about the attacks, and training users not to fall for the attacks. The existing methods for silently eliminating the attack and warning users about the attack are unlikely to perform flawlessly and as users are the weakest link in these attacks, it is essential that user training complement other methods. The goal of my thesis is to show that computer users trained with an embedded training system, one grounded in the principles of learning science are able to make more accurate online trust decisions than users who read traditional security training materials, which are distributed via email or posted online. To achieve this goal, I focus on “phishing,” a type of semantic attack. I have developed a system called “PhishGuru” based on embedded training methodology and learning science principles. Embedded training is a methodology in which training materials are integrated into the primary tasks users perform in their day-to-day lives. In contrast to existing training methodologies, the PhishGuru shows training materials to users through emails at the moment (“teachable moment”) users actually fall for phishing attacks. I evaluated the embedded training methodology through laboratory and field studies. Real-world experiments showed that people trained with PhishGuru retain knowledge even after 28 days. PhishGuru training does not decrease users’ willingness to click on links in legitimate messages. The design principles established in this thesis will help researchers to develop systems that can train users in other risky online situations. PhishGuru is also being used in a real-world implementation of the Anti-Phishing Working Group Landing Page initiative. PhishGuru is currently being commercialized by Wombat Security Technologies.
Recommandé
Recommandé
Contenu connexe
Plus de IIIT Hyderabad
Plus de IIIT Hyderabad (20)
Dernier
Dernier (20)
PhishGuru: A System for Educating Users about Semantic Attacks
- 1. CyLab Usable Privacy and Security Laboratory h7p://www.cs.cmu.edu/~ponguru 1 CyLab Usable Privacy and Security Laboratory h"p://cups.cs.cmu.edu/ PhishGuru: A System for Educa:ng Users about Seman:c A"acks Commi"ee Members: Lorrie Cranor (Chair) Jason Hong Vincent Aleven Rahul Tongia Alessandro Acquis: Ponnurangam Kumaraguru Computation, Organizations and Society School of Computer Science
- 11. CyLab Usable Privacy and Security Laboratory h7p://www.cs.cmu.edu/~ponguru 11 How do we get people trained? Problem – Exis:ng materials good, but could be be"er – Most people don’t proac:vely look for security training materials – “Security no:ce” emails sent to employees and/or customers tend to be ignored • Too much to read • People don’t consider them relevant Solu:on – Find a “teachable moment”: PhishGuru – Make training fun: An:‐Phishing Phil – Use learning science principles
- 19. CyLab Usable Privacy and Security Laboratory h7p://www.cs.cmu.edu/~ponguru 19 Is user educa:on possible? Security educa:on “puts the burden on the wrong shoulder.” [Nielsen, J. 2004. User educaIon is not the answer to security problems. h"p:// www.useit.com/alertbox/20041025.html.] “Security user educa:on is a myth.” [Gorling, S. 2006. The myth of user educaIon. In Proceedings of the 16th Virus Bulle:n Interna:onal Conference.] “User educa:on is a complete waste of :me. It is about as much use as nailing jelly to a wall…. They are not interested…they just want to do their job.” [Mar:n Overton, a U.K.‐based security specialist at IBM, quoted in h"p:// news.cnet.com/2100‐7350_3‐6125213‐2.html]
- 21. 21
- 22. CyLab Usable Privacy and Security Laboratory h7p://www.cs.cmu.edu/~ponguru 22 Web site training study Laboratory study of 28 non‐expert computer users Control group: evaluate 10 sites, 15 minute break to read email or play solitaire, evaluate 10 more sites Experimental group: evaluate 10 sites, 15 minutes to read web‐based training materials, evaluate 10 more sites Experimental group performed significantly be"er iden:fying phish aler training – But they had more false posi:ves People can learn from web‐based training materials, if only we could get them to read them! P. Kumaraguru, S. Sheng, A. Acquis:, L. Cranor, and J. Hong. Teaching Johnny Not to Fall for Phish. CyLab Technical Report CMU‐CyLab‐07003, 2007.
- 49. CyLab Usable Privacy and Security Laboratory h7p://www.cs.cmu.edu/~ponguru 49 Real world study: CMU Evaluate effec:veness of PhishGuru training in the real world Inves:gate reten:on aler 1 week, 2 weeks, and 4 weeks Compare effec:veness of 2 training messages with effec:veness of 1 training message P. Kumaraguru, J. Cranshaw, A. Acquis:, L. Cranor, J. Hong, M. A. Blair, and T. Pham. School of Phish: A Real‐World Evalua:on of An:‐Phishing Training. 2009. Under review.
- 50. CyLab Usable Privacy and Security Laboratory h7p://www.cs.cmu.edu/~ponguru 50 Study design Sent email to all CMU students, faculty and staff to recruit par:cipants to opt‐in to study 515 par:cipants in three condi:ons – Control – One training message – Two training messages Emails sent over 28 day period – 7 simulated spear‐phishing messages – 3 legi:mate messages from ISO (cyber security scavenger hunt) Exit survey
- 52. CyLab Usable Privacy and Security Laboratory h7p://www.cs.cmu.edu/~ponguru 52 Study schedule Day of the study Control One training message Two training messages Day 0 Test and real Train and real Train and real Day 2 Test Day 7 Test and real Day 14 Test Test Train Day 16 Test Day 21 Test Day 28 Test and real Day 35 Post‐study survey
- 56. CyLab Usable Privacy and Security Laboratory h7p://www.cs.cmu.edu/~ponguru 56 PhishGuru interven:on
- 57. CyLab Usable Privacy and Security Laboratory h7p://www.cs.cmu.edu/~ponguru 57 Effect of PhishGuru CondiIon N % who clicked on Day 0 % who clicked on Day 28 Control 172 52.3 44.2 Trained 343 48.4 24.5
- 58. CyLab Usable Privacy and Security Laboratory h7p://www.cs.cmu.edu/~ponguru 58 Results condi:oned on par:cipants who clicked on day 0 Control Onetrain Twotrain Control Onetrain Twotrain Control Onetrain Twotrain Control Onetrain Twotrain Control Onetrain Twotrain Control Onetrain Twotrain Day 2 Day 7 Day 14 Day 16 Day 21 Day 28 100 90 80 70 60 50 40 30 20 10 0 Percentage Only Clicked Clicked & Gave Control (N = 90) One-train (N = 89) Two-train (N = 77) Trained par:cipants less likely to fall for phish
- 59. CyLab Usable Privacy and Security Laboratory h7p://www.cs.cmu.edu/~ponguru 59 Results condi:oned on par:cipants who clicked on day 0 Control Onetrain Twotrain Control Onetrain Twotrain Control Onetrain Twotrain Control Onetrain Twotrain Control Onetrain Twotrain Control Onetrain Twotrain Day 2 Day 7 Day 14 Day 16 Day 21 Day 28 100 90 80 70 60 50 40 30 20 10 0 Percentage Only Clicked Clicked & Gave Control (N = 90) One-train (N = 89) Two-train (N = 77) Trained par:cipants less likely to fall for phish Trained par:cipants remember what they learned 28 days later
- 60. CyLab Usable Privacy and Security Laboratory h7p://www.cs.cmu.edu/~ponguru 60 Results condi:oned on par:cipants who clicked on day 0 and day 14 Control Onetrain Twotrain Control Onetrain Twotrain Control Onetrain Twotrain Day 16 Only Clicked Clicked & Gave Control (N = 54) One-train (N = 35) Two-train (N = 34) Day 21 Day 28 100 90 80 70 60 50 40 30 20 10 0 Percentage Two‐train par:cipants less likely than one‐train par:cipants to click on days 16 and 21
- 61. CyLab Usable Privacy and Security Laboratory h7p://www.cs.cmu.edu/~ponguru 61 Results condi:oned on par:cipants who clicked on day 0 and day 14 Control Onetrain Twotrain Control Onetrain Twotrain Control Onetrain Twotrain Day 16 Only Clicked Clicked & Gave Control (N = 54) One-train (N = 35) Two-train (N = 34) Day 21 Day 28 100 90 80 70 60 50 40 30 20 10 0 Percentage Two‐train par:cipants less likely than one‐train par:cipants to click on days 16 and 21 Two‐train par:cipants less likely than one‐train par:cipants to provide informa:on on day 28
- 62. CyLab Usable Privacy and Security Laboratory h7p://www.cs.cmu.edu/~ponguru 62 Legi:mate emails CondiIon N Day 0 Day 7 Day 28 Clicked % Clicked % Clicked % Control 90 50.0 41.1 38.9 One‐train 89 39.3 42.7 32.3 Two‐train 77 48.1 44.2 35.1 No difference between the three condi:ons on day 0, 7, and 28
- 63. CyLab Usable Privacy and Security Laboratory h7p://www.cs.cmu.edu/~ponguru 63 Legi:mate emails No difference between the three condi:ons on day 0, 7, and 28 No difference within the three condi:ons for the three emails CondiIon N Day 0 Day 7 Day 28 Clicked % Clicked % Clicked % Control 90 50.0 41.1 38.9 One‐train 89 39.3 42.7 32.3 Two‐train 77 48.1 44.2 35.1
- 66. CyLab Usable Privacy and Security Laboratory h7p://www.cs.cmu.edu/~ponguru 66 Summary of studies Studies Results Lab study I • Security no:ces are ineffec:ve • Users educated with PhishGuru made be"er decisions Lab study II • Users in embedded condi:on retain and transfer knowledge more effec:vely than other condi:ons even aler 7 days Real‐world study I • PhishGuru is effec:ve in training people in the real world • Trained par:cipants retained knowledge aler 7 days of training Real‐world study II • People trained with PhishGuru were less likely to click on phishing links than those not trained • People retained their training for 28 days • Two training messages are be"er than one • PhishGuru training does not make people less likely to click on legi:mate links
- 72. CyLab Usable Privacy and Security Laboratory h7p://www.cs.cmu.edu/~ponguru 72 An:‐Phishing Phil Online game h"p://wombatsecurity.com/an:phishingphil Teaches people how to protect themselves from phishing a"acks – iden:fy phishing URLs – use web browser cues – find legi:mate sites with search engines S. Sheng, B. Magnien, P. Kumaraguru, A. Acquis:, L. Cranor, J. Hong, and E. Nunge. An:‐Phishing Phil: The Design and Evalua:on of a Game That Teaches People Not to Fall for Phish. In Proceedings of the 2007 Symposium On Usable Privacy and Security, Pi"sburgh, PA, July 18‐20, 2007.
- 77. CyLab Usable Privacy and Security Laboratory h7p://www.cs.cmu.edu/~ponguru 77 Design principles Integrate security educa:on into users’ primary tasks Apply instruc:onal design principles to interven:ons – Comic strip format – Fun and interac:ve – Story format Format instruc:ons as a list of ac:onable items Make training repe::ve Keep training messages short and simple
- 82. http://phishguru.org/ CyLab Usable Privacy and Security Laboratory http://www.cs.cmu.edu/~ponguru/ Learn how to protect yourself from phishing attacks.