Study Determines Embedded Training Is Ineffective
ACQ Subscribe
Training that’s designed to help workers avoid clicking on links from spear-phishing e-mails is generally ineffective, says Eric Johnson, a Vanderbilt University professor who’s co-author of a new study on the subject.
“My old friend [chief security officer] John Stewart at Cisco says all links want to be clicked,” Johnson, dean of the Owen Graduate School of Management at Vanderbilt, says in an interview with Information Security Media Group. “There’s just something in there, even for the most astute security folks. When you get a link that looks like it’s real, looks like it came from a friend, has a compelling message, it’s very hard to pull the finger back from the mouse.”
As a result, even embedded training is ineffective, Johnson says, citing the research. Here’s how embedded training works: An employee receives a staged e-mail with a questionable link. When the user clicks on the link, the employee receives instructions – the embedded training – that explain what the employee did wrong by clicking on the link and how the user should respond.
Johnson says using technologies for “ensuring they never receive the e-mail to begin with, warning them appropriately in the e-mail or by catching them as they click and preventing that connection from occurring” could be more effective than training.
The new study, “Going Spear Phishing: Exploring Embedded
Training and Awareness,” which Johnson co-authored with Deanna Caputo and Jesse Freeman of MITRE and Shari Lawrence Pfleeger of the Institute for Information Infrastructure
Protection and Dartmouth College, also shows how a single spear-phishing campaign can generate as much as $150,000 in profits, vs. $14,000 for a mass phishing attack.
In the interview, Johnson:
- Defines embedded training and discusses how widespread it is,
- Explains why embedded training isn’t always effective; and
- Discusses possible solutions to get employees to not click on links in spear-phishing e-mails.
Before joining the Vanderbilt faculty last summer, Johnson served as associate dean for the MBA program and faculty director of the Glassmeyer/McNamee Center for Digital Strategies at Dartmouth College’s Tuck School of Business. His teaching and research focus on the impact of IT on the extended enterprise. Through federal grants, Johnson studies how IT improves process execution, but also how security failures create friction throughout the extended enterprise. He also focuses on the role of IT in improving healthcare quality and reducing cost. He has authored patents on interface design and has testified before Congress on information security.