Phishing susceptibility rate for multinational organizations

This master's thesis focuses on phishing as phenomenon, and specifically comparing the effectiveness of phishing emails that ask for credentials on a fake login page versus (Data entry attack) those that just require the victim to click a link (Click only attack). It also explores the effective...

Full description

Bibliographic Details
Main Author: Purhonen, Teemu
Other Authors: Informaatioteknologian tiedekunta, Faculty of Information Technology, Informaatioteknologia, Information Technology, Jyväskylän yliopisto, University of Jyväskylä
Format: Master's thesis
Language:eng
Published: 2023
Subjects:
Online Access: https://jyx.jyu.fi/handle/123456789/88542
_version_ 1826225753346277376
author Purhonen, Teemu
author2 Informaatioteknologian tiedekunta Faculty of Information Technology Informaatioteknologia Information Technology Jyväskylän yliopisto University of Jyväskylä
author_facet Purhonen, Teemu Informaatioteknologian tiedekunta Faculty of Information Technology Informaatioteknologia Information Technology Jyväskylän yliopisto University of Jyväskylä Purhonen, Teemu Informaatioteknologian tiedekunta Faculty of Information Technology Informaatioteknologia Information Technology Jyväskylän yliopisto University of Jyväskylä
author_sort Purhonen, Teemu
datasource_str_mv jyx
description This master's thesis focuses on phishing as phenomenon, and specifically comparing the effectiveness of phishing emails that ask for credentials on a fake login page versus (Data entry attack) those that just require the victim to click a link (Click only attack). It also explores the effectiveness of phishing emails written in English when the recipients are non-native English speakers (NNES). Phishing is defined as a scalable act of deception to obtain information, but it may involve different methods and goals. Phishing methods such as smishing (via SMS) and vishing (fake phone calls). Spear phishing targets a specific individual or small group, while whaling focuses on high-value targets. Phishing attacks can aim to gather information or inject malware into computer systems, and common tactics include impersonating trusted entities and creating fake login pages. Countermeasures against phishing attacks are necessary, as they account for 95% of successful attacks. A comprehensive approach is required, including technical countermeasures, information security policies and anti-phishing train-ing. As part of their anti-phishing training, cybersecurity department of one multinational organization has sent simulated phishing emails to their users. They have started to suspect that certain types of phishing emails, and with certain language (English or local language), are more successful than others. They have wanted to get concrete evidence for their suspicion to be able to enhance their anti-phishing training. To our knowledge, there have not been previous studies for this topic in a similar setting. A simulated phishing study was conducted on employees of the company. The employees received five phishing emails in either English or their local language, and then either Click only or Data entry phishing attack. The anti-phishing training system tagged participants as susceptible if they clicked the link or provided their credentials. This master’s thesis reveals that click only phishing attacks are more successful than data entry attacks. Additionally, we found that phishing emails in participants' native or local language have a higher success rate compared to those in English, supporting previous findings and suggesting that attackers using the local language achieve greater success.
first_indexed 2023-08-16T20:17:30Z
format Pro gradu
free_online_boolean 1
fullrecord [{"key": "dc.contributor.advisor", "value": "Siponen, Mikko", "language": "", "element": "contributor", "qualifier": "advisor", "schema": "dc"}, {"key": "dc.contributor.author", "value": "Purhonen, Teemu", "language": "", "element": "contributor", "qualifier": "author", "schema": "dc"}, {"key": "dc.date.accessioned", "value": "2023-08-16T05:32:25Z", "language": null, "element": "date", "qualifier": "accessioned", "schema": "dc"}, {"key": "dc.date.available", "value": "2023-08-16T05:32:25Z", "language": null, "element": "date", "qualifier": "available", "schema": "dc"}, {"key": "dc.date.issued", "value": "2023", "language": "", "element": "date", "qualifier": "issued", "schema": "dc"}, {"key": "dc.identifier.uri", "value": "https://jyx.jyu.fi/handle/123456789/88542", "language": null, "element": "identifier", "qualifier": "uri", "schema": "dc"}, {"key": "dc.description.abstract", "value": "This master's thesis focuses on phishing as phenomenon, and specifically comparing the effectiveness of phishing emails that ask for credentials on a fake login page versus (Data entry attack) those that just require the victim to click a link (Click only attack). It also explores the effectiveness of phishing emails written in English when the recipients are non-native English speakers (NNES).\nPhishing is defined as a scalable act of deception to obtain information, but it may involve different methods and goals. Phishing methods such as smishing (via SMS) and vishing (fake phone calls). Spear phishing targets a specific individual or small group, while whaling focuses on high-value targets. Phishing attacks can aim to gather information or inject malware into computer systems, and common tactics include impersonating trusted entities and creating fake login pages. Countermeasures against phishing attacks are necessary, as they account for 95% of successful attacks. A comprehensive approach is required, including technical countermeasures, information security policies and anti-phishing train-ing.\nAs part of their anti-phishing training, cybersecurity department of one multinational organization has sent simulated phishing emails to their users. They have started to suspect that certain types of phishing emails, and with certain language (English or local language), are more successful than others. They have wanted to get concrete evidence for their suspicion to be able to enhance their anti-phishing training. To our knowledge, there have not been previous studies for this topic in a similar setting. A simulated phishing study was conducted on employees of the company. The employees received five phishing emails in either English or their local language, and then either Click only or Data entry phishing attack. The anti-phishing training system tagged participants as susceptible if they clicked the link or provided their credentials.\nThis master\u2019s thesis reveals that click only phishing attacks are more successful than data entry attacks. Additionally, we found that phishing emails in participants' native or local language have a higher success rate compared to those in English, supporting previous findings and suggesting that attackers using the local language achieve greater success.", "language": "en", "element": "description", "qualifier": "abstract", "schema": "dc"}, {"key": "dc.description.provenance", "value": "Submitted by Paivi Vuorio (paelvuor@jyu.fi) on 2023-08-16T05:32:24Z\nNo. of bitstreams: 0", "language": "en", "element": "description", "qualifier": "provenance", "schema": "dc"}, {"key": "dc.description.provenance", "value": "Made available in DSpace on 2023-08-16T05:32:25Z (GMT). No. of bitstreams: 0\n Previous issue date: 2023", "language": "en", "element": "description", "qualifier": "provenance", "schema": "dc"}, {"key": "dc.format.extent", "value": "59", "language": "", "element": "format", "qualifier": "extent", "schema": "dc"}, {"key": "dc.language.iso", "value": "eng", "language": null, "element": "language", "qualifier": "iso", "schema": "dc"}, {"key": "dc.rights", "value": "In Copyright", "language": null, "element": "rights", "qualifier": null, "schema": "dc"}, {"key": "dc.subject.other", "value": "anti-phishing training", "language": "", "element": "subject", "qualifier": "other", "schema": "dc"}, {"key": "dc.subject.other", "value": "multinational", "language": "", "element": "subject", "qualifier": "other", "schema": "dc"}, {"key": "dc.title", "value": "Phishing susceptibility rate for multinational organizations", "language": "", "element": "title", "qualifier": null, "schema": "dc"}, {"key": "dc.type", "value": "master thesis", "language": null, "element": "type", "qualifier": null, "schema": "dc"}, {"key": "dc.identifier.urn", "value": "URN:NBN:fi:jyu-202308164652", "language": "", "element": "identifier", "qualifier": "urn", "schema": "dc"}, {"key": "dc.type.ontasot", "value": "Master\u2019s thesis", "language": "en", "element": "type", "qualifier": "ontasot", "schema": "dc"}, {"key": "dc.type.ontasot", "value": "Pro gradu -tutkielma", "language": "fi", "element": "type", "qualifier": "ontasot", "schema": "dc"}, {"key": "dc.contributor.faculty", "value": "Informaatioteknologian tiedekunta", "language": "fi", "element": "contributor", "qualifier": "faculty", "schema": "dc"}, {"key": "dc.contributor.faculty", "value": "Faculty of Information Technology", "language": "en", "element": "contributor", "qualifier": "faculty", "schema": "dc"}, {"key": "dc.contributor.department", "value": "Informaatioteknologia", "language": "fi", "element": "contributor", "qualifier": "department", "schema": "dc"}, {"key": "dc.contributor.department", "value": "Information Technology", "language": "en", "element": "contributor", "qualifier": "department", "schema": "dc"}, {"key": "dc.contributor.organization", "value": "Jyv\u00e4skyl\u00e4n yliopisto", "language": "fi", "element": "contributor", "qualifier": "organization", "schema": "dc"}, {"key": "dc.contributor.organization", "value": "University of Jyv\u00e4skyl\u00e4", "language": "en", "element": "contributor", "qualifier": "organization", "schema": "dc"}, {"key": "dc.subject.discipline", "value": "Kyberturvallisuus", "language": "fi", "element": "subject", "qualifier": "discipline", "schema": "dc"}, {"key": "dc.subject.discipline", "value": "Kyberturvallisuus", "language": "en", "element": "subject", "qualifier": "discipline", "schema": "dc"}, {"key": "yvv.contractresearch.funding", "value": "0", "language": "", "element": "contractresearch", "qualifier": "funding", "schema": "yvv"}, {"key": "dc.type.coar", "value": "http://purl.org/coar/resource_type/c_bdcc", "language": null, "element": "type", "qualifier": "coar", "schema": "dc"}, {"key": "dc.rights.copyright", "value": "\u00a9 The Author(s)", "language": null, "element": "rights", "qualifier": "copyright", "schema": "dc"}, {"key": "dc.rights.accesslevel", "value": "openAccess", "language": null, "element": "rights", "qualifier": "accesslevel", "schema": "dc"}, {"key": "dc.type.publication", "value": "masterThesis", "language": null, "element": "type", "qualifier": "publication", "schema": "dc"}, {"key": "dc.subject.oppiainekoodi", "value": "601", "language": "", "element": "subject", "qualifier": "oppiainekoodi", "schema": "dc"}, {"key": "dc.subject.yso", "value": "simulointi", "language": null, "element": "subject", "qualifier": "yso", "schema": "dc"}, {"key": "dc.subject.yso", "value": "verkkourkinta", "language": null, "element": "subject", "qualifier": "yso", "schema": "dc"}, {"key": "dc.subject.yso", "value": "kyberturvallisuus", "language": null, "element": "subject", "qualifier": "yso", "schema": "dc"}, {"key": "dc.subject.yso", "value": "simulation", "language": null, "element": "subject", "qualifier": "yso", "schema": "dc"}, {"key": "dc.subject.yso", "value": "phishing", "language": null, "element": "subject", "qualifier": "yso", "schema": "dc"}, {"key": "dc.subject.yso", "value": "cyber security", "language": null, "element": "subject", "qualifier": "yso", "schema": "dc"}, {"key": "dc.rights.url", "value": "https://rightsstatements.org/page/InC/1.0/", "language": null, "element": "rights", "qualifier": "url", "schema": "dc"}]
id jyx.123456789_88542
language eng
last_indexed 2025-02-18T10:55:23Z
main_date 2023-01-01T00:00:00Z
main_date_str 2023
online_boolean 1
online_urls_str_mv {"url":"https:\/\/jyx.jyu.fi\/bitstreams\/09c65d61-abbd-4884-9f0b-c29d085526ba\/download","text":"URN:NBN:fi:jyu-202308164652.pdf","source":"jyx","mediaType":"application\/pdf"}
publishDate 2023
record_format qdc
source_str_mv jyx
spellingShingle Purhonen, Teemu Phishing susceptibility rate for multinational organizations anti-phishing training multinational Kyberturvallisuus 601 simulointi verkkourkinta kyberturvallisuus simulation phishing cyber security
title Phishing susceptibility rate for multinational organizations
title_full Phishing susceptibility rate for multinational organizations
title_fullStr Phishing susceptibility rate for multinational organizations Phishing susceptibility rate for multinational organizations
title_full_unstemmed Phishing susceptibility rate for multinational organizations Phishing susceptibility rate for multinational organizations
title_short Phishing susceptibility rate for multinational organizations
title_sort phishing susceptibility rate for multinational organizations
title_txtP Phishing susceptibility rate for multinational organizations
topic anti-phishing training multinational Kyberturvallisuus 601 simulointi verkkourkinta kyberturvallisuus simulation phishing cyber security
topic_facet 601 Kyberturvallisuus anti-phishing training cyber security kyberturvallisuus multinational phishing simulation simulointi verkkourkinta
url https://jyx.jyu.fi/handle/123456789/88542 http://www.urn.fi/URN:NBN:fi:jyu-202308164652
work_keys_str_mv AT purhonenteemu phishingsusceptibilityrateformultinationalorganizations