Systems and methods for identifying and mitigating information security risks

Methods and systems for Sustained Testing and Awareness Refresh against Phishing threats (STAR*Phish™) are disclosed. In an embodiment, a method assigns schemes and unique identifiers to target e-mail addresses associated with a user accounts. The method delivers e-mail messages to the targeted e-mail addresses, the e-mail messages comprising an HTTP request and a unique identifier associated with each of the user accounts. The method then receives, at a Phishing Metric Tool (PMT), a response including the unique identifier. The PMT logs training requirements for the user accounts, tracks response metrics for the training requirements, and redirects the respective HTTP requests to a phishing training tool (PTT). The PTT sends a notification of the user account identities and the unique identifiers to the PMT and returns a status for the training requirements for the user accounts. Upon completion of the training, the PMT sends completion notifications for the user accounts.

CROSS-REFERENCE TO RELATED APPLICATIONS

The present application claims the benefit of U.S. Provisional Appl. No. 61/414,142 entitled “Phishing Awareness Training (PAT) Distinction Components,” filed Nov. 16, 2010, and U.S. Provisional Appl. No. 61/502,678 entitled “Phishing Awareness Training (PAT) Distinction Components,” filed Jun. 29, 2011. These prior applications are incorporated by reference herein in their entireties.

BACKGROUND OF THE DISCLOSURE

1. Field of the Disclosure

The field of the disclosure relates generally to information security training, and, more particularly, to phishing awareness training.

2. Description of the Related Art

Social engineering attacks, such as phishing, constitute a common threat to organization's information technology (IT) enterprise systems and data. Phishing attacks target individual users and seek to exploit them as the weakest link in the information security chain.

Conventional information security training consists of static presentations or test events that are exercised on a periodic basis (i.e., annually, quarterly, or monthly). However, given that attack methodologies are constantly evolving, information security threats quickly outpace the level of conventional training. This is especially true in the social engineering attack context. Accordingly, what is needed is more sophisticated information security training to better protect organizations and their data from these ever-evolving threats.

Traditional training techniques, such as annual data security training, are not targeted to susceptible users and fail to provide a consistent level of user awareness of security threats such as social engineering attacks. Accordingly, what is needed are systems and methods for providing a consistent level of user awareness and exploitation of a “teachable moment” operand conditioning in order to provide focused training for susceptible users.

SUMMARY OF THE DISCLOSURE

The present disclosure is directed to exemplary methods, exemplary apparatus and exemplary systems that provide phishing awareness training to targeted users.

Based on service-oriented design, exemplary embodiments of the present disclosure provide awareness on evolving threats as they are detected, rather than waiting for annual or quarterly training efforts. Additionally, exemplary embodiments disclosed herein provide tailored exercises which can be geared towards specific staff, such as new hires or contractors. Metrics from exercises can be tracked over time to determine the effectiveness of training across various objectives and organizational demographics as well.

Additionally, tailored exercises can be geared towards specific, targeted user accounts, such as, but not limited to, user accounts associated with new hires, contractors, or users who have demonstrated a propensity for falling victim to social engineering attacks, either simulated or real, in the past.

Techniques for Sustained Testing and Awareness Refresh against Phishing threats (STAR*Phish™) disclosed herein are distinguishable from conventional techniques in several ways. One key premise of the systems and methods disclosed herein is to focus on exploiting a “teachable moment” to target training towards susceptible users, which is an emerging concept that the training systems described herein are built around. In accordance with an exemplary embodiment, users are trained in live exercises coordinated with incident response personnel, and those users who fall victim are immediately transferred to a training component. According to an exemplary embodiment, STAR*Phish™ includes two components: a Phishing Metrics Tool (PMT), and a Phishing Training Tool (PTT).

While training provides an engaging environment to learn about various attack methodologies used in phishing, it is also tailored to reinforce correct reporting procedures. In the course of training, users are shown the correct and safe way to report phishing, which goes beyond what most available training resources currently provide. While providing information on the threat, STAR*Phish™ also provides information on responding to the threat within the environment the user operates in.

This response process is customized to client policies and procedures, rather than an ambiguous response approach that might not be relevant for all users. STAR*Phish™ takes a unique approach from an architectural standpoint as well, by providing a dual-domain system. According to an embodiment, the PMT is hosted on an external, un-trusted domain which lends credibility to the security threat for all responses. According to this example embodiment, users are actually clicking on links and being directed to websites that are external to their organization's environment, rather than accessing a simulated capture site inside their own, trusted environment. However, the PMT directs users to training which is located on a trusted internal site associated with their organization. In this way, the “bait” provides a high level of realism, but once the response is captured users are provided training on a trusted domain. This increases the likelihood that users will continue with their training requirement, rather than assuming the training is part of a phishing attack.

The PMT provides several unique capabilities. First, the phishing exercises allow phishing e-mails to be customized, including a wide variety of attacks such as attachments and full credential captures. The responses, and the “teachable moment”, can be caught at varying stages depending on the objectives of the exercise. For example, users can be directed to training immediately after clicking a link, or can be allowed to enter credentials or run embedded code before being transferred to training. Additionally, the metrics being tracked by the PMT are extremely diverse and not currently provided in such depth by conventional training systems. The PMT tracks response types, shows response graphs based on IP and target email, illustrates geographic distributions of responses, and even uses heuristics to determine social network maps and potential administrative hosts. The PMT also has an agent-based design that can be used to run distributed phishing exercises according to client requirements. Agents can be used to distribute phishing e-mails, track responses, and update a central collection agent that tracks the metrics.

Finally, STAR*Phish™ is modular, and can be tailored to meet specific client needs. If requested, the PMT can be used to run stand-alone exercises as part of penetration tests, or the PTT can be implemented to provide a stand-alone training resource.

In an embodiment, a computer-implemented method for training disclosed herein provides distinguishing features not found in conventional training systems. In accordance with an exemplary embodiment, there are two ways that users can take the training: voluntarily or as part of a mandatory requirement. Voluntary training is promoted through social media, including communities of practice and demonstrations. In accordance with an exemplary embodiment, users are provided with an ADOBE™ Flash-based training simulation that provides a virtual e-mail client interface, mimicking what they are likely to use in normal operations. In an alternative exemplary embodiment, the training simulation is ADOBE™ Flex-based. In yet another alternative exemplary embodiment, the training simulation is implemented in the HTML5 language.

If users have been directed to the training as a result of responding to a phishing e-mail, they are immediately trained on the e-mail that they were targeted with, capitalizing on the threat to which they have responded. Additionally, the mandatory training component is tracked as part of the live exercises, and users are sent notifications of their training requirement. This notification system, incorporated into the PMT, prevents users from simply ignoring poor security practices.

The present disclosure is directed to exemplary systems, architectures, methods, and non-transitory computer readable storage media for implementing STAR*Phish™.

The features and advantages of the present disclosure will become more apparent from the detailed description set forth below when taken in conjunction with the drawings, in which like reference characters identify corresponding elements throughout. In the drawings, like reference numbers generally indicate identical, functionally similar, and/or structurally similar elements. Generally, the drawing in which an element first appears is indicated by the leftmost digit(s) in the corresponding reference number.

DETAILED DESCRIPTION

The present disclosure relates to systems and methods for providing sustained testing and awareness against social engineering threats to information security, such as phishing threats. In particular, the systems and methods provide sustained user awareness training mechanism in a continuous, ongoing fashion and within a Web 2.0 training environment with live phishing exercises. In contrast to traditional periodic (e.g., annual) training, the systems and methods of the present disclosure provide a consistent level of user awareness and exploit “teachable moment” operand conditioning in order to provide focused training for users susceptible to social engineering attacks. Based on its service-oriented design, an exemplary system is able to provide awareness on evolving threats as they are detected, instead of waiting for an annual or quarterly training course. Additionally, tailored exercises delivered by the system can be geared towards specific staff, such as new hires or contractors. Metrics from the exercises can be tracked over time to determine effectiveness of training across various objectives and organizational demographics as well.

Embodiments of the systems and methods disclosed herein provide focused phishing awareness training wherein “teachable moments” are exploited so as to provide focused training for users that have demonstrated susceptibility to phishing. The systems and methods also adapt to evolving threats by including live exercises that are performed regularly with escalated complexity based on the level of user awareness demonstrated in previously-completed exercises. In embodiments, metrics from the exercises are tracked over time to determine the effectiveness of training across various objectives and organizational demographics. Embodiments also include customized training including components that can be implemented separately or in tandem to meet an organization's specific needs by merging testing and training components.

According to embodiments disclosed herein, live training exercises are coordinated using the PMT to allow testers to develop and send convincing, realistic phishing e-mail messages, track responses in real-time, and analyze and track metrics such as, but not limited to, response rates. As user responses are tracked by the PMT, teachable moments are exploited to train users while actions and perceptions are still fresh. In an embodiment, individual exercise components can be run without training to establish base metrics. Alternatively, exercise components can be included as part of an organization's penetration testing, which analyzes the impact of successful phishing attacks.

The methods and systems disclosed herein offer a training simulation that provides an engaging and informative environment that walks users through identification of suspicious e-mail messages and reinforces organizational reporting procedures. Embodiments of the training require uses to be fully engaged so that they are not merely clicking through and acknowledging a pre-determined sequence of screens. The training can be offered as a stand-alone component as well as a voluntary training resource. Through sustained use of the training, as opposed to traditional periodic training offered at set times, evolving threats are addressed and users are provided with consistent training opportunities that maintain user awareness at all times.

While the present disclosure is described herein with reference to illustrative embodiments for particular applications, it is to be understood that the invention is not limited thereto. Those skilled in the art with access to the teachings provided herein will recognize additional modifications, applications, and embodiments within the scope thereof and additional fields in which the invention would be of significant utility.

Unless specifically stated differently, in an embodiment, a user is interchangeably used herein to identify a human user, a software agent, or a group of users and/or software agents. Besides a human user who may be susceptible to information security breaches and phishing threats, a software application or agent sometimes can fall prey to information security attacks. Accordingly, unless specifically stated, the terms “user” and “user account” as used herein do not necessarily pertain to a human being.

FIG. 1depicts an enterprise system100, which allows a user account132to connect to web server128via Hypertext Transfer Protocol (HTTP) and Hypertext Transfer Protocol Secure (HTTPS) requests110, in accordance with an embodiment of the present disclosure. While this embodiment is described chiefly in terms of a connection between a user account132from a client machine and web server128, it is applicable to other servers such as e-mail server122. Although web server128is depicted as an Apache web server, as will be appreciated by persons skilled in the relevant art, web server128may be implemented as another Hypertext Transfer Protocol (HTTP) web server. Similarly, while servlet108is depicted inFIG. 1as an Apache Tomcat servlet, those skilled in the relevant art will appreciate that servlet108is not limited to being implemented as a Tomcat servlet.

System100utilizes a unique combination of training tied to a phishing exercise (e.g., a simulated attack via email messages). Phishing exercises, such as the ADOBE™ Flex and Flash training application112depicted inFIG. 1, utilize a unique identifier to track responses to specific crafted emails. The identifier allows reliable metrics, such as, but not limited to, geographic location, tracking, as well as association of user accounts132and their responses to specific exercises. In one embodiment, the identifier is a 16 digit number that forms part of a uniform resource locator (URL) sent as an HTTP request redirect. In another embodiment, the identifier may be a parameter passed with email messages and HTTP redirect messages.

PTT102/PMT124communications include the unique identifier in order to enable tracking of logins for user accounts132and training status. An update process allows PTT102to retrieve specific exercise e-mails from PMT124and include these in the training for targeted user accounts132.

System100has multiple components, each with a highly specialized function. The Phishing Training Tool (PTT)102is a data-driven training interface that is used to train susceptible users. In an embodiment, the Phishing Metrics Tool (PMT)124is a web-based content development and management interface that is used to generate phishing e-mails, such as Post Office Protocol (POP) and Internet message access protocol (IMAP) e-mail messages103, and track responses.

Deployment of system100for an organization entails customizing the components depicted inFIG. 1to meet organizational training directives and aesthetics. Additionally, while no sensitive data is stored in system100, individual instances of PMT124and PTT102are created to support a given organization, allowing for segregation of response statistics.

In order to provide realistic phishing exercises, in certain embodiments some aspect of the phishing exercise architecture for system100may reside on an untrusted domain external to the internal network114of the organization. For example, PMT124, its PMT database server126, and its web server128, may reside on an untrusted domain external to internal network114and PTT database server104and e-mail server122, which each reside on a trusted domain. As described below with reference toFIG. 2B, the use of Distributed Phishing Agents (DPAs), which can be registered on an untrusted domain for components of PMT124, can lend additional realism to the training exercise by making web server128and PMT database server126appear to be truly external to internal network114and the user's trusted domain.

Although PTT and PMT database servers104and126are shown in the exemplary embodiment ofFIG. 1as MySQL servers, as will be appreciated by persons skilled in the relevant art, database servers104and126may also host other relational database management systems (RDBMSs), such as, but not limited to, Oracle™ database servers, servers hosting MICROSOFT™ SQL Server databases, and Sybase™ database servers. Similarly, while exemplary e-mail server122is shown as a MICROSOFT™ Exchange server, those skilled in the relevant art will appreciate that the e-mail server122may also be implemented as other e-mail servers, such as, but not limited a Lotus Domino server, a Lotus Notes server, and a Novell GroupWise.

With continued reference toFIG. 1, the functionality of the components of system100are described below. The communications and relationships between the components of system100are described within the context of a computer-implemented method for providing sustained testing and awareness refresh training against social engineering threats to information security. Although the computer implemented method is described with reference to interactive computer-based training that improves an organization's awareness of phishing attacks, it is understood that the method can be applied to identifying and mitigating threats from other social engineering attacks. The steps of the computer implemented method do not necessarily have to occur in the order described below. As noted below, some of the steps are optional.

The method begins when target e-mail addresses for user accounts132are respectively assigned schemes and unique identifiers by PMT124. In an embodiment, structured query language (SQL) statements106are sent between PMT database server126and web server128within PMT124to accomplish the assignment of schemes and unique identifiers.

Next, e-mail messages are delivered to user accounts132with respective unique identifiers. As shown in the exemplary embodiment ofFIG. 1, this may be accomplished by sending Simple Mail Transfer Protocol (SMTP) requests130from web server128to e-mail server122. The e-mail messages are then downloaded by the user accounts132. In an embodiment, this may be done via POP/IMAP e-mail messages103sent via e-mail server122.

Then, a vulnerable user logged into a user account132supplies a response to PMT124via an HTTP/HTTPS request110to web server128. The HTTP/HTTPS request110includes the unique identifier discussed above. At this point, PMT124updates a status for the responding user account132, logs a training requirement, and tracks response metrics for user account132. As illustrated inFIG. 1, the status update, logging and metrics tracking can be accomplished by sending SQL statements106between PMT database server126and web server128.

Next, the user associated with user account132is redirected to PTT102in real-time immediately after capturing the response, thus exploiting a “teachable moment” while the user's susceptibility to the simulated phishing attack is fresh in his mind. This re-direct can be accomplished by sending an HTTP/HTTPS redirect request110from to user account132from training application112within PTT102. Although training application112is depicted in as an ADOBE™ Flex or Flash application, it is understood that training application112can be implemented in other development environments and languages, such as, but not limited to, HTML5.

As an optional step, user account132may be directed to PTT102via another HTTP/HTTPS request110from the training application112after a reminder notification has been sent. User account132may also be sent an HTTP/HTTPS response110from the training application112via web server128for voluntary training. In another optional step, user credentials for user account132are sent via a Lightweight Directory Access Protocol (LDAP) request118from servlet108to account database116within internal network114. These user credentials can then be validated, providing confirmation of the identity of a user account132respondent. Next, PTT102sends notification of respondent identity and identifier to PMT124via an HTTP/HTTPS response110.

During the execution of training application112by the user associated with user account132, PMT124iteratively updates the training status and returns training exercise e-mail contents as applicable. According to one embodiment, this can be done by sending SQL statements106between PMT database server126and web server128.

As an optional step, PMT124may send a reminder notification in response to determining that a user associated with a user account132does not complete the training within a designated time period. This notification can be sent via POP/IMAP e-mail messages103from e-mail server122to user account132. In embodiments, the designated time period is a tunable parameter that can be adjusted by a training or system administrator of internal network114. For example, the time period may be set to a predetermined number of hours, days, or weeks, as deemed necessary by the administrator.

Upon determining that the training has been completed by the user associated with user account132, PTT102sends a completion notification. This notification can be sent as an HTTP/HTTPS response110between training application112and web server128. In one embodiment, this step may additionally include generation and display of a completion certificate by training application112. According to embodiments, the completion notification and/or certificate can be sent to user account132and an administrator for internal network114.

Lastly, PMT124updates the status for user account132and sends a completion e-mail message to user account132. As shown inFIG. 1, this completion e-mail message can be sent as an SMTP request130from web server128via e-mail server122.

FIGS. 2A and 2Bdepict exemplary architectures and process diagrams for identifying and mitigating information security risks in an architecture without and with distributed phishing agents, respectively, in accordance with embodiments of the present disclosure.FIGS. 2A and 2Bare described with continued reference to the embodiments illustrated inFIG. 1However,FIGS. 2A and 2Bare not limited to those embodiments.

As part of coordination tasks, an organization (i.e., “Client Y” in the exemplary embodiments ofFIGS. 2A and 2B) in need of phishing awareness training may supply information about a valid e-mail server122, such as public mail server202, that can be used to send e-mails to user accounts132within client network204.

In accordance with an embodiment, customized version of the base instance of PTT102, such as the client Y PTT instance219depicted inFIG. 2A, is deployed in Xservices environment217. This allows trusted communications by deploying valid Secure Sockets Layer (SSL) certificates, plus the reliability of a hosted environment like Xservices environment217.

As shown inFIG. 2A, in architecture200without distributed phishing agents, an isolated instance of the base instance of PMT124is deployed as a client Y PMT instance209on Penetration Testing Environment207. This allows simulated attacks without compromising internal security policies. This isolated instance is shown inFIG. 2Aas Client Y PMT instance209.

Client Y PMT instance209sends e-mail messages203to a client-designated mail server, such as public mail server202. Next, a susceptible user associated with a user account132within client network204clicks on a simulated phishing link/URL, triggering an HTTP/HTTPS request205to client Y PMT instance209. According to an embodiment, client network204may be internal network114described above with reference toFIG. 1.

At this point, user account132is redirected to Client Y PTT instance219via an HTTP/HTTPS redirect request213. Next, client Y PTT instance219and client Y PMT instant209coordinate training content and track completion statistics. As illustrated inFIG. 2Aand described with reference toFIG. 1above, this coordination can be accomplished by sending HTTP/HTTPS requests and responses215between client Y PTT instance219and client Y PMT instant209.

FIG. 2Bdepicts an architecture210and process diagram for identifying and mitigating information security risks in an architecture with distributed phishing agents, in accordance with an embodiment of the present disclosure.

Within architecture210, Distributed Phishing Agents (DPA)201are registered domains with no traceable connection to the host organization or internal network114, and serve as proxies for capturing responses. According to an embodiment, DPAs201are registered domains that act as proxies that redirect users to appropriate resources, allowing the exercises to use a variety of links and avoid altered responses based on recognition of target uniform resource locators (URLs).

As show inFIG. 2B, client Y PMT instance209sends e-mail messages203to a client-designated mail server, such as public mail server202. Next, a susceptible user associated with a user account132within client network204clicks on a simulated phishing link/URL, triggering an HTTP/HTTPS request223to a DPA201. According to an embodiment, client network204may be internal network114described above with reference toFIG. 1, but the DPAs201are external to client network204.

Next, the user associated with user account132is redirected to client Y PTT instance219via an HTTP/HTTPS redirect213sent from the DPA201to client Y PTT instance219. As shown inFIG. 2B, DPA201also updates client Y PMT instant209with response details225for user account132.

At this point in the process, client Y PTT instance219and client Y PMT instant209coordinate training content, track completion statistics. As illustrated inFIG. 2Bdescribed above with reference toFIGS. 1 and 2Aabove, this coordination can be accomplished by sending HTTP/HTTPS requests and responses215between client Y PTT instance219and client Y PMT instant209.

FIG. 3is a message sequence chart illustrating a method300of sustained testing and awareness refresh against phishing threats in accordance with other exemplary embodiments.

FIG. 3is described with continued reference to the embodiments illustrated inFIGS. 1,2A and2B. However,FIG. 3is not limited to those embodiments.

Method300handles cases where a phishing HTTP request is sent from a browser session in response to a susceptible user clicking on a simulated phishing link. According to an embodiment, the browser session may be an Internet browser web-based e-mail client launched by a user associated with a user account132to read e-mail delivered by e-mail server122.

Method300begins at step336where a phishing HTTP/HTTPS request is sent from browser334to PMT124. As would understood by persons skilled in the relevant art, the method300can be applied to various Internet browsers, including, but not limited to, MICROSOFT™ Internet Explorer, Mozilla Firefox, GOOGLE™ Chrome, APPLE Safari, and OPERA™.

In step338, a redirect message is sent from PMT124to browser334so that in step340, an application request can be sent from browser334to PTT102. The request sent in step340can be for any embodiment of training application112described above with reference toFIG. 1.

In step342, training application112is sent from PTT102to browser334. Although training application112is shown inFIG. 3as an ADOBE™ Flex application, as described above with reference toFIG. 1and step340, in alternative embodiments, training application can be an ADOBE™ Flash application or an application developed in other environments/languages such as HTML5.

In steps344-354, which are included in an optional login process within method300, login credentials for user account132are sent and verified.

In step344, login credentials for user account132are sent from browser334to PTT102, which in turn forwards the credentials to servlet108in step346. While servlet108is depicted inFIG. 3as an Apache Tomcat servlet, those skilled in the relevant art will appreciate that servlet108is not limited to being implemented as a Tomcat servlet.

In step348, an LDAP request118is sent by servlet108so that the credentials can be successfully verified in step349. As described above with reference toFIG. 1, credential verification in this step may include checking the credentials against an account database116within internal network114.

In step350, an LDAP-verification status is sent to servlet108so that the user account132can be logged in and a user session can be created in step352.

In step354, an indication of the verified login is sent from servlet108to PTT102.

In step356, an advance page is sent from PTT102to browser334. In an embodiment, this advance page indicates in the browser session that a training exercise is required.

In step358, a start exercise message is sent from PTT102to PMT124. According to an embodiment, the start exercise message includes a unique identifier uniquely identifying the user account132that needs to complete the exercise provided by training application112.

In step360, the user associated with user account132can review informational slides regarding the exercise, which are displayed by browser334.

In step362, a request for the exercise is sent from browser334to PTT102. Although the exercise is shown as an ADOBE™ Flex-based exercise inFIG. 3, it is to be understood that the exercise can be ADOBE™ Flash-based or developed using other languages such as, but not limited to, HTML5.

In step364, the exercise is sent from PTT102to browser334so that the user associated with user account132can run the exercise on browser334in step366.

In step368, upon completion of the exercise, a completion notification is sent from browser334to PTT102and in response, PTT102sends an exercise completion message to PMT124in step370.

In step372, the user associated with user account132can optionally send a request from browser334to PTT102so that PTT102can send an HTML completion certificate back to browser334in step374.

FIGS. 4-12depict example graphical user interfaces (GUIs) for displaying and information pertaining to sustained testing and awareness refresh against phishing threats. In an embodiment, a server side administrator application may include the exemplary interface illustrated inFIG. 4.

According to an embodiment, browser334may display the exemplary interface illustrated inFIGS. 5-12.FIGS. 4-12are described with continued reference to the embodiments illustrated inFIGS. 1-3. However,FIGS. 5-12are not limited to those embodiments. ThroughoutFIGS. 5-12, displays are shown with various hyperlinks, command regions, tabs, buttons, checkboxes, and data entry fields, which are used to initiate action, invoke routines, enter data, view data, or invoke other functionality, such as functionality of training application112. For brevity, only the differences occurring within the figures, as compared to previous or subsequent ones of the figures, are described below.

FIG. 4illustrates an exemplary GUI for viewing and editing task scheme information within a server side administrative interface, in accordance with an embodiment of the present disclosure.FIG. 4illustrates a top-level administrative interface400for displaying and editing training settings associated with PMT124. Administrative interface400is a server side administrative interface used to customize task schemes, such as the schemes described with reference toFIG. 1above.

By clicking create classification link476, an administrator for internal network114can create a classification for a training exercise. By selecting template links478, the administrator can create and edit schemes.FIG. 4also includes management links480, which allow the administrator to create and edit training tasks in addition to customizing templates. Management links480also allow security reports to be viewed and edited and enable viewing and modification of control tasks.

Along with disseminating the phishing e-mail messages, PMT124can aggregate and track metrics for both past and ongoing exercises through use of control tasks link488within management links480. Reporting links482within administrative interface400allow viewing of e-mail demographics, task status, and training metrics reports.

As shown inFIG. 4, classifications menu484for PMT124allows operators and administrators to select multiple phishing attack vectors for an exercise. Some exemplary attack vectors are provided in the exemplary classifications menu484. However, it is to be understood that the list of attack vectors shown inFIG. 4is not exhaustive. These attack vectors can be further customized through addition of attachments in attachments window486.

FIG. 5illustrates an exemplary web-based e-mail interface590, which can be used by a user associated with user account132to retrieve POP/IMAP e-mail messages103from e-mail server122. As shown inFIG. 5, a sample phishing e-mail message592can be displayed by e-mail interface590in the recipient's mailbox. The phishing e-mail message592displayed within e-mail interface590may include instructions to click on a seemingly innocuous phishing hyperlink594.

Upon determining that a user has selected phishing hyperlink594, the notification screen depicted inFIG. 6can be displayed within browser334. As shown in phishing URL696ofFIG. 6, embedded in phishing e-mail message592, user account132received a unique ID. Although the unique ID is shown in exemplaryFIG. 6as a 16-digit number as part of phishing URL696, in alternative embodiments, the unique ID may have a different length, form, or be passed as a separate parameter. When phishing hyperlink596is selected, the unique ID, the user account132receives immediate notification698of the training requirement. Notification698takes advantage of the “teachable moment” by immediately informing the user what was done incorrectly, why this is a threat, and what should be done differently in the future. Additionally, informational message699can be displayed to allow the user to contact the help desk, if he/she is suspicious that the page shown inFIG. 6is not authentic. This gives the user a way to confirm that they need to take the training.

FIGS. 7-12depict a simulated browser e-mail client interface790used as part of a phishing training exercise. According to an embodiment, simulated browser e-mail client interface790may be provided by training application112via web server128.

In the exemplary embodiment shown inFIG. 7, upon launching a browser session within browser334and logging into a user account132, a welcome message is displayed within dialog box702with instructions for the training exercise.FIG. 8illustrates that a user can select a training e-mail message804displayed within simulated browser e-mail client interface790. As shown inFIG. 8, a cumulative score is displayed within interface790(in the exemplary display ofFIG. 8, the cumulative score is 790 because the training exercise has just begun).

FIGS. 9-12depict how (semi) randomly determined elements904of simulated phishing e-mail messages can be displayed within simulated browser e-mail client interface790. As shown inFIG. 9, for each of the (semi) randomly determined elements904of the e-mail message, the user is asked to click and categorize each as ‘Neutral’ or ‘Suspicious’ by selecting buttons in dialog box906. As illustrated inFIG. 10, correct and incorrect choices are explained in dialog box1008, which the user must acknowledge before proceeding with the training exercise.

FIG. 11depicts how incorrect and correct phrases1112can be indicated within simulated browser e-mail client interface790. In the exemplary embodiment described inFIG. 11, incorrect phrases1112are highlighted in red and correct phrases1112are highlighted in green. As shown inFIG. 11, a number of remaining attempts and remaining phrases1112can also be displayed in simulated browser e-mail client interface790. With continued reference toFIG. 11, a message1110informs the user whether he has selected enough correct phrases1112. In an embodiment, if not enough correct phrases have been selected and if this is the first attempt, the user may be told that he has not selected enough words and should try again. Alternatively, if this is the second attempt, a second message1110can be displayed, providing information that will help identify the phrases1112that should have been chosen. This message1110can also show points for the phrases that are correct. As shown inFIG. 12, after determining whether the training was completed successfully, either a congratulatory message1214or a further information message1216is displayed within simulated browser e-mail client interface790. In the exemplary embodiment ofFIG. 12, the further information message1216can include information on how to identify incorrect phrases. If enough correct phrases1112have been selected, a congratulatory message1214is displayed. At this point, to finish the e-mail exercise, the user can select the “Other Actions” button1212.

Although exemplary embodiments have been described in terms of a computer implemented method or apparatus, it is contemplated that it may be implemented by microprocessors of a computer, such as the computer system1300illustrated inFIG. 13. In various embodiments, one or more of the functions of the various components may be implemented in software that controls a computing device, such as computer system1300, which is described below with reference toFIG. 13. The processor(s) of the computer system are configured to execute the software recorded on a non-transitory computer-readable recording medium, such as a hard disk drive, ROM, flash memory, optical memory, or any other type of non-volatile memory.

Aspects of the present disclosure shown inFIGS. 1-12, or any part(s) or function(s) thereof, may be implemented using hardware, software modules, firmware, tangible computer readable media having instructions stored thereon, or a combination thereof and may be implemented in one or more computer systems or other processing systems.

FIG. 13illustrates an example computer system1300in which embodiments of the present disclosure, or portions thereof, may be implemented as computer-readable code. For example, system100and architectures200and210ofFIGS. 1,2A and2B, can be implemented in computer system1300using hardware, software, firmware, non-transitory computer readable media having instructions stored thereon, or a combination thereof and may be implemented in one or more computer systems or other processing systems. Hardware, software, or any combination of such may embody any of the modules and components used to implement the system and architectures ofFIGS. 1,2A and2B. Similarly, hardware, software, or any combination of such may embody modules and components used to implement the method ofFIG. 3.

If programmable logic is used, such logic may execute on a commercially available processing platform or a special purpose device. One of ordinary skill in the art may appreciate that embodiments of the disclosed subject matter can be practiced with various computer system configurations, including multi-core multiprocessor systems, minicomputers, mainframe computers, computers linked or clustered with distributed functions, as well as pervasive or miniature computers that may be embedded into virtually any device.

For instance, at least one processor device and a memory may be used to implement the above described embodiments. A processor device may be a single processor, a plurality of processors, or combinations thereof. Processor devices may have one or more processor “cores.”

Processor device1304may be a special purpose or a general purpose processor device. As will be appreciated by persons skilled in the relevant art, processor device1304may also be a single processor in a multi-core/multiprocessor system, such system operating alone, or in a cluster of computing devices operating in a cluster or server farm. Processor device1304is connected to a communication infrastructure1306, for example, a bus, message queue, network, or multi-core message-passing scheme.

Computer system1300also includes a main memory1308, for example, random access memory (RAM), and may also include a secondary memory1310. Secondary memory1310may include, for example, a hard disk drive1312, removable storage drive1314. Removable storage drive1314may comprise a floppy disk drive, a magnetic tape drive, an optical disk drive, a flash memory, or the like.

The removable storage drive1314reads from and/or writes to a removable storage unit1318in a well known manner. Removable storage unit1318may comprise a floppy disk, magnetic tape, optical disk, etc. which is read by and written to by removable storage drive1314. As will be appreciated by persons skilled in the relevant art, removable storage unit1318includes a non-transitory computer usable storage medium having stored therein computer software and/or data.

In alternative implementations, secondary memory1310may include other similar means for allowing computer programs or other instructions to be loaded into computer system1300. Such means may include, for example, a removable storage unit1322and an interface1320. Examples of such means may include a program cartridge and cartridge interface (such as that found in video game devices), a removable memory chip (such as an EPROM, or PROM) and associated socket, and other removable storage units1322and interfaces1320which allow software and data to be transferred from the removable storage unit1322to computer system1300. Computer system1300may also include a communications interface1324.

Communications interface1324allows software and data to be transferred between computer system1300and external devices. Communications interface1324may include a modem, a network interface (such as an Ethernet card), a communications port, a PCMCIA slot and card, or the like. Software and data transferred via communications interface1324may be in the form of signals, which may be electronic, electromagnetic, optical, or other signals capable of being received by communications interface1324. These signals may be provided to communications interface1324via a communications path1326. Communications path1326carries signals and may be implemented using wire or cable, fiber optics, a phone line, a cellular phone link, an RF link or other communications channels. In this document, the terms “computer program medium,” “non-transitory computer readable medium,” and “computer usable medium” are used to generally refer to media such as removable storage unit1318, removable storage unit1322, and a hard disk installed in hard disk drive1312. Signals carried over communications path1326can also embody the logic described herein. Computer program medium and computer usable medium can also refer to memories, such as main memory1308and secondary memory1310, which can be memory semiconductors (e.g. DRAMs, etc.). These computer program products are means for providing software to computer system1300.

Computer programs (also called computer control logic) are stored in main memory1308and/or secondary memory1310. Computer programs may also be received via communications interface1324. Such computer programs, when executed, enable computer system1300to implement the present disclosure as discussed herein. In particular, the computer programs, when executed, enable processor device1304to implement the processes of the present disclosure, such as the stages in the methods illustrated by the message sequence chart300ofFIG. 3, discussed above. Accordingly, such computer programs represent controllers of the computer system1300. Where the present disclosure is implemented using software, the software may be stored in a computer program product and loaded into computer system1300using removable storage drive1314, interface1320, and hard disk drive1312, or communications interface1324.

It is to be appreciated that the Detailed Description section, and not the Summary and Abstract sections, is intended to be used to interpret the claims. The Summary and Abstract sections may set forth one or more but not all exemplary embodiments of the present disclosure as contemplated by the inventor(s), and thus, are not intended to limit the present disclosure and the appended claims in any way. Embodiments of the present disclosure have been described above with the aid of functional building blocks illustrating the implementation of specified functions and relationships thereof. The boundaries of these functional building blocks have been arbitrarily defined herein for the convenience of the description. Alternate boundaries can be defined so long as the specified functions and relationships thereof are appropriately performed.