Purpose This study aimed to investigate how honest participants perceived an attacker to be during shoulder surfing scenarios that varied in terms of which Principle of Persuasion in Social Engineering (PPSE) was used, whether perceived honesty changed as scenarios progressed, and whether any changes were greater in some scenarios than others. Design/methodology/approach Participants read one of six shoulder surfing scenarios. Five depicted an attacker using one of the PPSEs. The other depicted an attacker using as few PPSEs as possible, which served as a control condition. Participants then rated perceived attacker honesty. Findings The results revealed honesty ratings in each condition were equal during the beginning of the conversation, participants in each condition perceived the attacker to be honest during the beginning of the conversation, perceived attacker honesty declined when the attacker requested the target perform an action that would afford shoulder surfing, perceived attacker honesty declined more when the Distraction and Social Proof PPSEs were used, participants perceived the attacker to be dishonest when making such requests using the Distraction and Social Proof PPSEs and perceived attacker honesty did not change when the attacker used the target’s computer. Originality/value To the best of the authors’ knowledge, this experiment is the first to investigate how persuasion tactics affect perceptions of attackers during shoulder surfing attacks. These results have important implications for shoulder surfing prevention training programs and penetration tests.

Purpose Nonexperts do not always follow the advice in cybersecurity warning messages. To increase compliance, it is recommended that warning messages use nontechnical language, describe how the cyberattack will affect the user personally and do so in a way that aligns with how the user thinks about cyberattacks. Implementing those recommendations requires an understanding of how nonexperts think about cyberattack consequences. Unfortunately, research has yet to reveal nonexperts’ thinking about cyberattack consequences. Toward that end, the purpose of this study was to examine how nonexperts think about cyberattack consequences. Design/methodology/approach Nonexperts sorted cyberattack consequences based on perceived similarity and labeled each group based on the reason those grouped consequences were perceived to be similar. Participants’ labels were analyzed to understand the general themes and the specific features that are present in nonexperts’ thinking. Findings The results suggested participants mainly thought about cyberattack consequences in terms of what the attacker is doing and what will be affected. Further, the results suggested participants thought about certain aspects of the consequences in concrete terms and other aspects of the consequences in general terms. Originality/value This research illuminates how nonexperts think about cyberattack consequences. This paper also reveals what aspects of nonexperts’ thinking are more or less concrete and identifies specific terminology that can be used to describe aspects that fall into each case. Such information allows one to align warning messages to nonexperts’ thinking in more nuanced ways than would otherwise be possible.

Purpose This study aims to examine how social engineers use persuasion principles during vishing attacks. Design/methodology/approach In total, 86 examples of real-world vishing attacks were found in articles and videos. Each example was coded to determine which persuasion principles were present in that attack and how they were implemented, i.e. what specific elements of the attack contributed to the presence of each persuasion principle. Findings Authority (A), social proof (S) and distraction (D) were the most widely used persuasion principles in vishing attacks, followed by liking, similarity and deception (L). These four persuasion principles occurred in a majority of vishing attacks, while commitment, reciprocation and consistency (C) did not. Further, certain sets of persuasion principles (i.e. authority, distraction, liking, similarity, and deception and social proof; , authority, commitment, reciprocation, and consistency, distraction, liking, similarity and deception, and social proof; and authority, distraction and social proof) were used more than others. It was noteworthy that despite their similarities, those sets of persuasion principles were implemented in different ways, and certain specific ways of implementing certain persuasion principles (e.g. vishers claiming to have authority over the victim) were quite rare. Originality/value To the best of authors’ knowledge, this study is the first to investigate how social engineers use persuasion principles during vishing attacks. As such, it provides important insight into how social engineers implement vishing attacks and lays a critical foundation for future research investigating the psychological aspects of vishing attacks. The present results have important implications for vishing countermeasures and education.

The problem of detecting phishing emails through machine learning techniques has been discussed extensively in the literature. Conventional and state-of-the-art machine learning algorithms have demonstrated the possibility of building classifiers with high accuracy. The existing research studies treat phishing and genuine emails through general indicators and thus it is not exactly clear what phishing features are contributing to variations of the classifiers. In this paper, we crafted a set of phishing and legitimate emails with similar indicators in order to investigate whether these cues are captured or disregarded by email embeddings, i.e., vectorizations. We then fed machine learning classifiers with the carefully crafted emails to find out about the performance of email embeddings developed. Our results show that using these indicators, email embeddings techniques is effective for classifying emails as phishing or legitimate.

More specialized cybersecurity education programs are needed to address workforce needs, but it is unclear which knowledge, skills, and abilities (KSAs) fulfil industry needs. We interviewed 48 professionals within four cyber defense specialty areas: (1) Cyber Network Defense Analysis, (2) Cyber Network Defense Infrastructure Support, (3) Incident Response, and (4) Vulnerability Assessment and Management. The professionals rated a number of specialized KSAs along two dimensions: how important the KSA was to their job and how difficult the KSA was to learn. Overall, communication and other non-technical skills were rated as being very important for all cyber defense jobs. Findings indicated that, for some specialty areas, technical knowledge and skills vary considerably between jobs and so the ability to teach oneself is more valuable than proficiency in any one KSA. Findings may be used to inform the development of general cybersecurity curricula, as well as curricula that focus on Cyber Network Defense Analysis, Cyber Network Defense Infrastructure Support, or Vulnerability Assessment and Management.

There is a growing need for cybersecurity professionals with the knowledge, skills, and abilities (KSAs) necessary for risk and vulnerability analysis. Cybersecurity curricula should emphasize KSAs most important in cyber work. To determine which KSAs should be prioritized in curricula, we interviewed 38 cyber professionals with a specialty in vulnerability assessment and management. Interviews took place at the premier hacking conferences Black Hat and DEF CON in 2016 and 2017. Participants rated the importance of 31 KSAs taken from the National Initiative for Cybersecurity Education's Cybersecurity Workforce Framework. Of the 31 KSAs, 12 were rated as being significantly important to vulnerability assessment and management work. Half of these KSAs dealt with system and application vulnerabilities (e.g., Skills in conducting vulnerability scans and recognizing vulnerabilities). The other 6 most important KSAs concerned attacks (e.g., Knowledge of different classes of attacks), penetration testing (e.g., Skill in the use of penetration testing tools and techniques), and network protocols (e.g., Knowledge of network protocols). Overall, results suggest that vulnerability assessment students should graduate with: 1) knowledge of and skills in identifying vulnerabilities and robustness of systems and applications; 2) conceptual familiarity with classes of attacks and attack stages; 3) knowledge of and skills in penetration testing principles and tools, and 4) knowledge of network traffic and network protocols. Handouts will be provided.

Our cybersecurity workforce needs surpass our ability to meet them. These needs could be mitigated by developing relevant curricula that prioritize the knowledge, skills, and abilities (KSAs) most important to cybersecurity jobs. To identify the KSAs needed for performing cybersecurity jobs, we administered survey interviews to 44 cyber professionals at the premier hacker conferences Black Hat 2016 and DEF CON 24. Questions concerned 32 KSAs related to cyber defense. Participants rated how important each KSA was to their job and indicated where they had learned that KSA. Fifteen of these KSAs were rated as being of higher-than-neutral importance. Participants also answered open-ended questions meant to uncover additional KSAs that are important to cyber-defense work. Overall, the data suggest that KSAs related to networks, vulnerabilities, programming, and interpersonal communication should be prioritized in cybersecurity curricula.

There is a job gap in cybersecurity with many more security jobs than qualified candidates. The cybersecurity workforce shortage could be mitigated by developing better curricula that prioritize the Knowledge, Skills, and Abilities (KSAs) most important to security related jobs. To determine which KSAs should be included in cybersecurity education and training, we administered survey-interviews to 44 security professionals at the premier hacking conferences Black Hat and DEF CON. Questions concerned 32 cybersecurity-relevant KSAs. Participants were asked how important each KSA was to their job and where they had learned that KSA. Fifteen KSAs were rated as being of higher-than-neutral importance. Most of these important KSAs concerned networks (example KSA: knowledge of network protocols) and threats/vulnerabilities (example KSA: knowledge of types of security threats and vulnerabilities). Of the 32 KSAs, participants learned the most about 31 of them while on the job and not through formal training. Overall, the data suggest that network KSAs and threat and vulnerability KSAs should be prioritized in course curricula and that historically threat and vulnerability KSAs have not been emphasized in school. This work is supported by National Science Foundation under award number DGE-1516636.