Stimulus Materials Training Approach Participants who underwent training were welcomed to the training by a message from the university CIO, which stressed the importance of the training and thanked them for their participation. Next, participants were told that the university was experiencing an increase in phishing attacks and were shown information about the adverse consequences of responding to a phishing attack (e.g., endangering personal and institutional resources, compromising confidential information). Then, participants were exposed to one of the training programs that were designed to test the competing training approaches: a concrete approach that encourages email users to follow several best practice recommendations for secure email use and an abstract approach that encourages email users to mindfully pause and reflect about the validity of requests they receive through email. These training programs and how they reflect the competing theoretical approaches are discussed in more detail below. Following training, participants were asked to practice identifying phishing emails and were instructed to identify two legitimate and two phishing emails. Correct answers and explanations consistent with the training approach (concrete or abstract) were provided immediately after participants submitted their answers. Training concluded with participants completing a knowledge test based on the specific training program that provided correct answers and explanations after the test was complete. The concrete training content was derived from anti-phishing recommendations found in academic, governmental, non-profit, and corporate sources. We first gathered recommendations for email users as set forth by previous anti-phishing researchers (). We then reconciled this list with resources provided by the U.S. Federal Trade Commission, the non-profit group antiphishing.org, and anti-phishing best practices suggested by an international bank. The combined list of recommendations from these sources was long and in some cases, was customized to specific types of interactions (e.g., online purchases or online banking). Across sources, we identified six consistent recommendations shown in Table 3. As a final check to determine the suitability of these recommendations for a university environment, we presented the recommendations to two independent IT security managers employed at
Pr(Responding to Phishing Attack) = β0 + β1*Student Status + β2*Faculty Status + β3*Trait Mindfulness + β4*Propensity to Trust + β5*Propensity to Take Risks + β6*Computer Self Efficacy + β7* Phishing Identification Expertise + β8*Phishing Customization + β9*Situation-Specific Training Approach + β10*Mindfulness Training Approach + β11*Graphical Training Format (2) The participant status was recoded from a three-value categorical variable (i.e., student, staff, faculty) to two dichotomous dummy variables (student status, faculty status). This model also examines the effect of phishing email customization, training approach, and training format on the likelihood of responding to a phishing attack and is the central analysis of this research. Factor scores were calculated via a confirmatory factor analysis (CFA) using MPlus 6.1 and utilized in the model. This procedure provided participants’ mean-centered, composite score for each covariate. Forty-seven participants in the training sample (including the survey-only condition) logged in to the fictitious website, resulting in a response rate of 13.2 percent. Descriptive statistics showing the number of participant responses and response rate in each condition are shown in Table 7. These findings are consistent with past industry reports on phishing response rates which indicate between a 10-15 percent rate of response for novice individuals (). Figure 2 displays the timing of the responses to the phishing attack during the first four 24 hour periods after the first email was sent (10:00 AM). The attack generated the greatest response on the first day and decreased sharply on subsequent days. During the first 36 hours, responses were greatest in the evening when participants were most likely at home. Table – Participant responses to phishing email Conditions Generic Phishing Messagea Custom Phishing Messagea Survey Only 8 (24.2%) 9 (22.5%) Concrete Text 4 (11.8%) 6 (15.0%) Graphics 5 (15.2%) 5 (11.9%) Abstract Text 3 (7.5%) 4 (12.5%) Graphics 2 (7.4%) 1 (2.9%)